va-scanCopyright 2002, Marchany Securing Solaris Servers Randy Marchany

va-scanCopyright 2002, Marchany General Strategy  Most Solaris security checklists recommend installing the minimum set of software needed to run the system.  Most sysadmins don’t do this.  General strategy – Remove all privilege and access and grant or enable only what is needed. – Enable as much system logging as possible!

va-scanCopyright 2002, Marchany Two Strategies  Use the SANS Securing Solaris checklist  Use the Center for Internet Security Securing Solaris Benchmark  Use the CERT Securing Solaris Server checklist. – Use the SANS or CIS checklists when the CERT checklist recommends it.

va-scanCopyright 2002, Marchany Solaris Installation  Disconnect the system from the net? – Optional  Download patches, other software to another machine if possible.  Obtain the following information – IP name, IP address, subnet mask, default gateway, DNS server, Domain name, Time Zone

va-scanCopyright 2002, Marchany Solaris Installation  Boot time configuration – SANS Guide steps , Basic OS Installation – Step 1.1.5, select ‘other’.  Minimal OS installation (optional) – SANS Guide steps , select “system accounting”.

va-scanCopyright 2002, Marchany Solaris Hardening  Remove all packages not needed for the operation of the server.  Verify /etc/hostname. contains only the machine name.  Verify /etc/inet/hosts (aka /etc/hosts) contains the following entries: – localhost – FQDN UQHN loghost – central syslog server (optional)

va-scanCopyright 2002, Marchany Solaris Hardening  Verify /etc/nsswitch.conf contains the following entry: – hosts: files dns  Verify /etc/netmasks contains: – – SANS guide steps – 1.35, Post Install/networking configuration – Pick a secure password for the root account – SANS guide steps , Installing Patches

va-scanCopyright 2002, Marchany Solaris Hardening  Installing patches takes time, about 1 hour.  It’s CRITICAL that you install the most current set of patches. Check security patches at least once a month. Use tools like patchdiag or GASP to make installation easier.  Install Tripwire.  Install SSH

va-scanCopyright 2002, Marchany Solaris Hardening  SANS Guide step 2.1.1, purging boot directories of Unnecessary Services  SANS Guide step , 2.1.7, 2.1.8, 2.1.9, – Set umask to 027  Remove all services from /etc/inet.conf  SANS Guide , Cleaning House

va-scanCopyright 2002, Marchany Solaris Hardening  Install TCP Wrappers  SANS Guide , file system configuration  Set enhanced syslog logging – Set debug level for kern, user, mail, daemon, auth, syslog, lpr, news, uucp, cron, local0-7  SANS Guide , Additional Logging

va-scanCopyright 2002, Marchany Solaris Hardening  Sendmail – Obtain updated sendmail kit via anonymous ftp. One such site is: ftp.vt.edu/pub/cc/Solaris/sendmail*2.8*  SANS guide  SANS guide , Miscellaneous