1. va-scanCopyright 2002, Marchany Securing Solaris Servers Randy Marchany

2. va-scanCopyright 2002, Marchany General Strategy  Most Solaris security checklists recommend installing the minimum set of software needed to run the system.  Most sysadmins don’t do this.  General strategy – Remove all privilege and access and grant or enable only what is needed. – Enable as much system logging as possible!

3. va-scanCopyright 2002, Marchany Two Strategies  Use the SANS Securing Solaris checklist  Use the Center for Internet Security Securing Solaris Benchmark  Use the CERT Securing Solaris Server checklist. – Use the SANS or CIS checklists when the CERT checklist recommends it.

4. va-scanCopyright 2002, Marchany Solaris Installation  Disconnect the system from the net? – Optional  Download patches, other software to another machine if possible.  Obtain the following information – IP name, IP address, subnet mask, default gateway, DNS server, Domain name, Time Zone

5. va-scanCopyright 2002, Marchany Solaris Installation  Boot time configuration – SANS Guide steps 1.1.1-1.1.8, Basic OS Installation – Step 1.1.5, select ‘other’.  Minimal OS installation (optional) – SANS Guide steps 1.2.1-1.2.7, select “system accounting”.

6. va-scanCopyright 2002, Marchany Solaris Hardening  Remove all packages not needed for the operation of the server.  Verify /etc/hostname. contains only the machine name.  Verify /etc/inet/hosts (aka /etc/hosts) contains the following entries: – 127.0.0.1 localhost – FQDN UQHN loghost – central syslog server (optional)

7. va-scanCopyright 2002, Marchany Solaris Hardening  Verify /etc/nsswitch.conf contains the following entry: – hosts: files dns  Verify /etc/netmasks contains: – – SANS guide steps 1.3.1 – 1.35, Post Install/networking configuration – Pick a secure password for the root account – SANS guide steps 1.4.2-1.4.7, Installing Patches

8. va-scanCopyright 2002, Marchany Solaris Hardening  Installing patches takes time, about 1 hour.  It’s CRITICAL that you install the most current set of patches. Check security patches at least once a month. Use tools like patchdiag or GASP to make installation easier.  Install Tripwire.  Install SSH

9. va-scanCopyright 2002, Marchany Solaris Hardening  SANS Guide step 2.1.1, purging boot directories of Unnecessary Services  SANS Guide step 2.1.2-2.1.5, 2.1.7, 2.1.8, 2.1.9, 2.1.10 – Set umask to 027  Remove all services from /etc/inet.conf  SANS Guide 2.2.1-2.2.5, Cleaning House

10. va-scanCopyright 2002, Marchany Solaris Hardening  Install TCP Wrappers  SANS Guide 2.3.1-2.3.3, file system configuration  Set enhanced syslog logging – Set debug level for kern, user, mail, daemon, auth, syslog, lpr, news, uucp, cron, local0-7  SANS Guide 2.4.3-2.4.4, Additional Logging

11. va-scanCopyright 2002, Marchany Solaris Hardening  Sendmail – Obtain updated sendmail kit via anonymous ftp. One such site is: ftp.vt.edu/pub/cc/Solaris/sendmail*2.8*  SANS guide 2.6.1-2.6.5  SANS guide 2.7.1-2.7.9, Miscellaneous