| 1.Disabled Volume Management # cd /etc/rc2.d # mv S92volmgt s92volmgt After this configuration, CD-ROMs will not be automatically mounted. To manually mount a CD-ROM use: # mount -F hsfs -o ro /dev/dsk/c0t6d0s0 /mnt 2.Disabled Dtlogin Dtlogin is disabled if the server is not intended to run the Common Desktop Environment (CDE) or GUIs. # cd /etc/rc2.d # mv S99dtlogin s99dtlogin 3.Disabled Printing # /usr/lib/lpshut # cd /etc/rc2.d # mv S80lp s80lp 4.Disabled RPC RPC is disabled if the server is not intended to run CDE. To determine what is using rcp, use “rpcinfo –p”. # cd /etc/rc2.d # mv /etc/rc2.d/S71rpc /etc/rc2.d/s71rpc 5.Disabled the NFS Client # /etc/init.d/nfs.client stop # cd /etc/rc2.d # mv S73nfs.client s73nfs.client 6.Disabled the NFS Server # /etc/init.d/nfs.server stop # cd /etc/rc3.d # mv S15nfs.server s15nfs.server 7.Disabled UUCP # cd /etc/rc2.d # mv S70uucp s70uucp 8.Disabled the LDAP Client # cd /etc/rc2.d # mv S71ldap.client s71ldap.client 9.Disabled the Auto Mounter # /etc/init.d/autofs stop # cd /etc/rc2.d # mv S74autofs s74autofs 10.Disabled the Network Time Daemon # /etc/init.d/xntpd stop # cd /etc/rc2.d # mv S74xntpd s74xntpd 11.Disabled the Logical Link Control Driver # cd /etc/rc2.d # ./S40llc2 stop # mv S40llc2 s40llc2 12.Disabled Auto Install # cd /etc/rc2.d # mv S72autoinstall s72autoinstall 13.Disabled Cachefs Daemon # cd /etc/rc2.d # mv S73cachefs.daemon s73cachefs.daemon 14.Disabled Asynchronous PPP Daemon # cd /etc/rc2.d # mv S47pppd s47pppd 15.Disabled cacheos.finish Script # cd /etc/rc2.d # mv S93cacheos.finish s93cacheos.finish 16.Disabled Preservation of Files Killed by Vi # cd /etc/rc2.d # mv S80PRESERVE s80PRESERVE 17.Disabled Power Management # cd /etc/rc2.d # mv S85power s85power 18.Disabled Flash Prom Update # cd /etc/rc2.d # mv S75flashprom s75flashprom Before attempting to update the eeprom, temporally enable this script. 19.Disabled “Buttons n Dials-Setup” # cd /etc/rc2.d # mv S89bdconfig s89bdconfig 20.Disabled Spc # cd /etc/rc2.d # mv S80spc s80spc 21.Disabled Sun Management Center # cd /etc/rc2.d # mv S90wbem s90wbem 22.Disabled Network Cache and Accelerator # cd /etc/rc2.d # mv S94ncalogd s94ncalogd # mv S95ncad s95ncad Used to increase web server performance 23.Disabled Mobile IP Agent # cd /etc/rc3.d # mv S80mipagent s80mipagent 24.Disabled SNMP # cd /etc/rc3.d # /usr/bin/pkill -9 -x -u 0 '(snmpdx|snmpv2d|mibiisa)' # mv S76snmpdx s76snmpdx 25.Disabled Apache # cd /etc/rc3.d # mv S50apache s50apache 26.Disabled DMI # cd /etc/rc3.d # /usr/bin/pkill -9 -x -u 0 '(snmpXdmid|dmispd)' # mv S77dmi s77dmi 27.Disabled the Sendmail Daemon The system continues to send mail out. It does not receive mail in to the server. This eliminates a significant security vulnerability. # /etc/init.d/sendmail stop Prevented sendmail from starting at boot: # cd /etc/rc2.d # mv S88sendmail s88sendmail Ensured the sendmail queue is cleaned out: # crontab –e # The Sendmail daemon is not running - This tells it to send mail out 05,20,35,50 * * * * /usr/lib/sendmail –q 28.Disabled Multicasting Multicasting is typically used for clustering. Ensure that it is not required by an application. # vi /etc/init.d/inetsvc # # Add a static route for multicast packets out our default interface. # The default interface is the interface that corresponds to the node name. # #mcastif=`/sbin/dhcpinfo Yiaddr` # #if [ $? -ne 0 ]; then # mcastif=`uname -n` #fi # #echo "Setting default interface for multicast: \c" #/usr/sbin/route add -interface -netmask "240.0.0.0" "224.0.0.0" "$mcastif" 29.Disabled the Serial Port Listeners This configuration can be accomplished unless there is a modem or console terminal attached to the system. # vi /etc/inittab Remove the line with “/usr/lib/saf/sac -t 300” # chown root:sys /etc/inittab # chmod 644 /etc/inittab 1.Added Warning Banners These configurations replace the operating system version with a warning banner displayed during the login process. Login: # vi /etc/motd (replaced operating system version with a warning banner) Property of Company WARNING: To protect systems from unauthorized use and to ensure that the system is functioning properly, activities on this system are monitored and recorded and subject to audit. Use of this system is expressed consent to such monitoring and recording. Any unauthorized access or use of this system is prohibited and could be subject to criminal and civil penalties. # cp /etc/motd /etc/issue Telnet: # vi /etc/default/telnetd UMASK=022 BANNER="" # chown root:sys /etc/default/telnetd # chmod 444 /etc/default/telnetd FTP: # vi /etc/default/ftpd UMASK=022 BANNER=`cat /etc/motd` # chown root:sys /etc/default/ftpd # chmod 444 /etc/default/ftpd 2.Enabled Logging of the su Command This configuration logs both success and failure of su command usage. NOTE: This configuration is required by the root login notification script (below). # vi /etc/default/su SULOG=/var/adm/sulog (uncommented) # cd /var/adm # touch sulog # chgrp sys sulog # chmod 600 sulog 3.Enabled AUTH Logging The auth facility controls account access with login, su, etc. # vi /etc/syslog.conf auth.info /var/log/authlog auth.notice /var/log/authlog NOTE: The entries must be separated by tabs. # /etc/init.d/syslog stop # /etc/init.d/syslog start 4.Enabled Logging of Unsuccessful Login Attempts The loginlog file records consecutive failed login attempts. # cd /var/adm # touch loginlog # chgrp sys loginlog # chmod 600 loginlog 5.Enabled Logging of Successful Logins # cd /var/log # touch logins # chgrp sys logins # chmod 600 logins # vi /etc/syslog.conf # log successful logins local0.info /var/log/logins NOTE: The entries must be separated by tabs. # /etc/init.d/syslog stop # /etc/init.d/syslog start Added the following entry to /etc/profile and /etc/.login: logger -p local0.info "User $LOGNAME has logged in" 6.Enabled Logging of CDE Login Attempts # vi /etc/pam.conf Added the word “debug” after the account management entries # # Account management # login account required /usr/lib/security/$ISA/pam_unix.so.1 debug dtlogin account required /usr/lib/security/$ISA/pam_unix.so.1 debug # vi /etc/syslog.conf Added “;auth.debug;user.debug” to the line that logs successful logins # log successful logins local0.info;auth.debug;user.debug /var/log/logins NOTE: The entries must be separated by tabs. # /etc/init.d/syslog stop # /etc/init.d/syslog start 7.Enabled Performance Logging # su – sys # EDITOR=vi; export EDITOR # crontab –e # The sys crontab should be used to do performance collection. See cron # and performance manual pages for details on startup. # 0 * * * 0-6 /usr/lib/sa/sa1 20,40 6-22 * * 1-5 /usr/lib/sa/sa1 5 18 * * 1-5 /usr/lib/sa/sa2 -s 8:00 -e 18:01 -i 1200 -A |
相关文章
Copyright © 2003-2006 iTePub Online Services. All Rights Reserved.
Template Designed by iTePub. Optimized For 1024x768 to Firefox,Opera And MS-IE6.
