| Acknowledgements |
|
iii | |
| Preface |
|
xxi | |
| Part 1. Solaris Operating Environment Security |
|
|
Solaris Operating Environment Security |
|
|
3 | (38) |
|
File Systems and Local Security |
|
|
4 | (19) |
|
|
|
4 | (1) |
|
|
|
5 | (1) |
|
|
|
6 | (3) |
|
|
|
9 | (4) |
|
|
|
13 | (2) |
|
|
|
15 | (1) |
|
|
|
16 | (3) |
|
|
|
19 | (1) |
|
Miscellaneous Configuration |
|
|
20 | (3) |
|
|
|
23 | (16) |
|
|
|
24 | (1) |
|
|
|
24 | (1) |
|
|
|
25 | (1) |
|
Remote Access Services (rsh, rlogin, and rcp) |
|
|
26 | (1) |
|
Remote Execution Service (rexec) |
|
|
26 | (1) |
|
|
|
26 | (1) |
|
|
|
27 | (1) |
|
|
|
28 | (1) |
|
|
|
29 | (2) |
|
|
|
31 | (1) |
|
|
|
32 | (1) |
|
|
|
33 | (1) |
|
Name Service Caching (nscd) |
|
|
34 | (1) |
|
|
|
35 | (1) |
|
|
|
36 | (1) |
|
|
|
36 | (1) |
|
|
|
36 | (1) |
|
|
|
37 | (1) |
|
|
|
38 | (1) |
|
|
|
39 | (2) |
|
Network Settings for Security |
|
|
41 | (24) |
|
|
|
42 | (2) |
|
Notes on Parameter Changes |
|
|
43 | (1) |
|
Address Resolution Protocol (ARP) |
|
|
44 | (4) |
|
|
|
45 | (1) |
|
|
|
46 | (2) |
|
Internet Control Message Protocol (ICMP) |
|
|
48 | (3) |
|
|
|
48 | (2) |
|
|
|
50 | (1) |
|
|
|
51 | (5) |
|
|
|
51 | (2) |
|
Strict Destination Multihoming |
|
|
53 | (1) |
|
Forwarding Directed Broadcasts |
|
|
53 | (1) |
|
|
|
54 | (1) |
|
Forwarding Source Routed Packets |
|
|
55 | (1) |
|
Transmission Control Protocol (TCP) |
|
|
56 | (5) |
|
|
|
56 | (2) |
|
Connection Exhaustion Attacks |
|
|
58 | (1) |
|
|
|
59 | (2) |
|
Common TCP and UDP Parameters |
|
|
61 | (2) |
|
|
|
61 | (2) |
|
Changing the Ephemeral Port Range |
|
|
63 | (1) |
|
Script for Implementing ndd Commands |
|
|
63 | (1) |
|
|
|
64 | (1) |
|
|
|
65 | (22) |
|
|
|
66 | (2) |
|
|
|
68 | (1) |
|
|
|
68 | (5) |
|
Verifying JumpStart Software |
|
|
69 | (1) |
|
Installing Core Solaris OE Cluster |
|
|
70 | (1) |
|
|
|
70 | (1) |
|
Removing Unnecessary Packages |
|
|
71 | (1) |
|
Using JumpStart Software to Configure the OS |
|
|
71 | (1) |
|
Installing and Configuring Software Packages |
|
|
72 | (1) |
|
|
|
72 | (1) |
|
Testing Software Installation |
|
|
72 | (1) |
|
Final Configuration of iPlanet Web Server 4.1 |
|
|
73 | (12) |
|
|
|
73 | (4) |
|
|
|
77 | (3) |
|
|
|
80 | (5) |
|
|
|
85 | (2) |
|
|
|
85 | (1) |
|
|
|
85 | (2) |
|
|
|
87 | (24) |
|
Sun SHIELD Basic Security Module (BSM) |
|
|
88 | (1) |
|
|
|
88 | (1) |
|
|
|
89 | (1) |
|
|
|
90 | (2) |
|
|
|
92 | (3) |
|
|
|
92 | (1) |
|
|
|
92 | (1) |
|
|
|
92 | (1) |
|
|
|
93 | (1) |
|
|
|
93 | (1) |
|
|
|
94 | (1) |
|
|
|
94 | (1) |
|
|
|
95 | (1) |
|
|
|
95 | (2) |
|
|
|
97 | (7) |
|
|
|
98 | (1) |
|
|
|
98 | (1) |
|
|
|
99 | (3) |
|
|
|
102 | (1) |
|
|
|
103 | (1) |
|
|
|
103 | (1) |
|
|
|
104 | (1) |
|
audit_control, audit_class, and audit_event Files |
|
|
105 | (2) |
|
|
|
105 | (1) |
|
Modified audit_class File |
|
|
105 | (1) |
|
Modified audit_event File |
|
|
106 | (1) |
|
audit_event Modifications |
|
|
107 | (1) |
|
|
|
107 | (1) |
|
|
|
108 | (3) |
| Part II. Architecture Security |
|
|
Building Secure N-Tier Environments |
|
|
111 | (18) |
|
Is There a Silver Bullet? |
|
|
112 | (1) |
|
|
|
113 | (4) |
|
|
|
114 | (1) |
|
|
|
114 | (1) |
|
|
|
115 | (1) |
|
Storage Area Network Tier |
|
|
115 | (1) |
|
|
|
115 | (1) |
|
ExtraNet/Service Provider Tier |
|
|
116 | (1) |
|
|
|
116 | (1) |
|
|
|
117 | (1) |
|
|
|
117 | (1) |
|
System Build Requirements |
|
|
117 | (3) |
|
|
|
118 | (1) |
|
|
|
118 | (1) |
|
|
|
118 | (1) |
|
|
|
119 | (1) |
|
Communication and IP Forwarding |
|
|
120 | (1) |
|
|
|
120 | (1) |
|
|
|
121 | (1) |
|
|
|
121 | (3) |
|
|
|
122 | (1) |
|
Web Server-Application Server Tier |
|
|
122 | (1) |
|
Application Server Tier-Database Tier |
|
|
122 | (1) |
|
ExtraNet Tier-Database Tier |
|
|
122 | (1) |
|
Backup Tier-Systems Being Backed Up |
|
|
123 | (1) |
|
San Tier-Systems Using SAN |
|
|
123 | (1) |
|
Management Tier-All Servers |
|
|
123 | (1) |
|
|
|
124 | (1) |
|
|
|
124 | (1) |
|
|
|
125 | (1) |
|
|
|
125 | (1) |
|
|
|
126 | (1) |
|
|
|
126 | (3) |
| Part III. Justification for Security |
|
|
How Hackers Do It: Tricks, Tools, and Techniques |
|
|
129 | (22) |
|
|
|
130 | (2) |
|
Finding Access Vulnerabilities |
|
|
130 | (1) |
|
Finding Operating System Vulnerabilities |
|
|
131 | (1) |
|
Attacking Solaris OE Vulnerabilities |
|
|
131 | (1) |
|
|
|
132 | (3) |
|
|
|
132 | (1) |
|
|
|
133 | (1) |
|
|
|
134 | (1) |
|
|
|
134 | (1) |
|
|
|
135 | (3) |
|
Attacks From the Internet |
|
|
135 | (2) |
|
|
|
137 | (1) |
|
|
|
138 | (9) |
|
|
|
138 | (1) |
|
Using Vulnerability Scanners |
|
|
139 | (2) |
|
|
|
141 | (3) |
|
|
|
144 | (3) |
|
|
|
147 | (1) |
|
|
|
147 | (4) |
|
|
|
147 | (1) |
|
|
|
147 | (4) |
| Part IV. Tools Security |
|
|
Solaris Fingerprint Database |
|
|
151 | (12) |
|
|
|
152 | (1) |
|
|
|
153 | (1) |
|
|
|
153 | (1) |
|
Downloading and Installing MD5 |
|
|
153 | (2) |
|
Creating an MD5 Digital Fingerprint |
|
|
155 | (1) |
|
Testing an MD5 Digital Fingerprint |
|
|
156 | (1) |
|
|
|
157 | (2) |
|
|
|
159 | (1) |
|
Solaris FingerPrint Database Companion (sfpC) |
|
|
159 | (1) |
|
Solaris Fingerprint Database Sidekick (sfpS) |
|
|
159 | (1) |
|
Frequently Asked Questions |
|
|
160 | (1) |
|
|
|
160 | (3) |
| Part V. Hardware and Software Security |
|
|
Securing the Sun Fire 15K System Controller |
|
|
163 | (28) |
|
Introduction to Sun Fire 15K SC |
|
|
164 | (1) |
|
Assumptions and Limitations |
|
|
165 | (1) |
|
Understanding the SC Functions |
|
|
166 | (2) |
|
|
|
167 | (1) |
|
System Management Services (SMS) Software |
|
|
167 | (1) |
|
Securing the Sun Fire 15K SC |
|
|
168 | (1) |
|
Solaris Security Toolkit Software |
|
|
168 | (1) |
|
|
|
169 | (1) |
|
Default SC SMS Software Configuration |
|
|
169 | (6) |
|
SC Solaris OE SMS Packages |
|
|
170 | (1) |
|
SC SMS Accounts and Security |
|
|
171 | (2) |
|
|
|
173 | (2) |
|
|
|
175 | (4) |
|
Main SC Network Interfaces |
|
|
176 | (2) |
|
Spare SC Network Interfaces |
|
|
178 | (1) |
|
Secured SC Solaris OE Configuration |
|
|
179 | (1) |
|
|
|
179 | (2) |
|
Implementing the Recommendations |
|
|
181 | (8) |
|
|
|
181 | (4) |
|
Securing the SC with the Solaris Security Toolkit Software |
|
|
185 | (4) |
|
|
|
189 | (2) |
|
Securing Sun Fire 15K Domains |
|
|
191 | (24) |
|
|
|
192 | (1) |
|
|
|
193 | (1) |
|
Assumptions and Limitations |
|
|
193 | (2) |
|
|
|
193 | (1) |
|
|
|
194 | (1) |
|
|
|
194 | (1) |
|
Solaris Security Toolkit Software |
|
|
194 | (1) |
|
|
|
194 | (1) |
|
|
|
194 | (1) |
|
Domain Solaris OE Configuration |
|
|
195 | (2) |
|
Sun Fire 15K Domain Hardening |
|
|
197 | (5) |
|
Standalone Versus JumpStart Modes |
|
|
197 | (1) |
|
Solaris Security Toolkit Software |
|
|
197 | (1) |
|
|
|
198 | (4) |
|
Installing Security Software |
|
|
202 | (5) |
|
Installing the Solaris Security Toolkit Software |
|
|
202 | (2) |
|
Installing the Recommended and Security Patch Clusters |
|
|
204 | (1) |
|
Installing the FixModes Software |
|
|
205 | (1) |
|
Installing the OpenSSH Software |
|
|
206 | (1) |
|
Installing the MD5 Software |
|
|
206 | (1) |
|
Domain Solaris OE Modifications |
|
|
207 | (3) |
|
Executing the Solaris Security Toolkit Software |
|
|
207 | (2) |
|
Verifying Domain Hardening |
|
|
209 | (1) |
|
Secured Domain Solaris OE Configuration |
|
|
210 | (3) |
|
Solaris Security Toolkit Scripts |
|
|
213 | (1) |
|
|
|
214 | (1) |
|
Securing Sun Enterprise 10000 System Service Processors |
|
|
215 | (40) |
|
|
|
216 | (13) |
|
Assumptions and Limitations |
|
|
216 | (1) |
|
Qualified Software Versions |
|
|
217 | (1) |
|
|
|
218 | (1) |
|
Sun Enterprise 10000 System Features and Security |
|
|
218 | (1) |
|
System Service Processor (SSP) |
|
|
219 | (5) |
|
Solaris OE Defaults and Modifications |
|
|
224 | (5) |
|
Building a Secure Sun Enterprise 10000 System |
|
|
229 | (21) |
|
Modifying Network Topology |
|
|
229 | (5) |
|
Installing Main SSP Detection Script |
|
|
234 | (1) |
|
|
|
235 | (8) |
|
Creating Domain Administrator Accounts |
|
|
243 | (1) |
|
Adding Host-Based Firewalls |
|
|
244 | (6) |
|
|
|
250 | (2) |
|
|
|
250 | (1) |
|
|
|
251 | (1) |
|
Sample SunScreen Software Configuration File |
|
|
252 | (1) |
|
|
|
253 | (2) |
|
Sun Cluster 3.0 (12/01) Security with the Apache and iPlanet Web and Messaging Agents |
|
|
255 | (28) |
|
|
|
256 | (1) |
|
|
|
257 | (1) |
|
Assumptions and Limitations |
|
|
258 | (3) |
|
|
|
258 | (1) |
|
Sun Cluster 3.0 (12/01) Software |
|
|
258 | (1) |
|
iPlanet Web and Messaging Servers and Apache Web Server Supported |
|
|
259 | (1) |
|
Solaris OE Packages and Installation |
|
|
259 | (1) |
|
Cluster Interconnect Links |
|
|
259 | (1) |
|
Solaris Security Toolkit Software |
|
|
260 | (1) |
|
Security Modification Scope |
|
|
260 | (1) |
|
|
|
260 | (1) |
|
Solaris OE Service Restriction |
|
|
261 | (6) |
|
|
|
262 | (3) |
|
|
|
265 | (2) |
|
|
|
267 | (1) |
|
|
|
268 | (1) |
|
|
|
268 | (2) |
|
Securing Sun Cluster 3.0 Software |
|
|
270 | (8) |
|
Installing Security Software |
|
|
270 | (5) |
|
Sun Cluster 3.0 Node Solaris OE Modifications |
|
|
275 | (3) |
|
|
|
278 | (1) |
|
Maintaining a Secure System |
|
|
279 | (1) |
|
Solaris Security Toolkit Software Backout Capabilities |
|
|
280 | (1) |
|
|
|
281 | (2) |
|
Securing the Sun Fire Midframe System Controller |
|
|
283 | (44) |
|
System Controller (SC) Overview |
|
|
284 | (1) |
|
Midframe Service Processor |
|
|
285 | (2) |
|
|
|
285 | (1) |
|
|
|
286 | (1) |
|
|
|
287 | (3) |
|
|
|
288 | (1) |
|
Control-A and Control-X Commands |
|
|
288 | (2) |
|
|
|
290 | (1) |
|
|
|
291 | (12) |
|
|
|
296 | (1) |
|
Solaris Security Toolkit Installation |
|
|
297 | (1) |
|
Recommended and Security Patch Installation |
|
|
298 | (2) |
|
Solaris Security Toolkit Execution |
|
|
300 | (1) |
|
|
|
301 | (2) |
|
SC Application Security Settings |
|
|
303 | (10) |
|
|
|
304 | (7) |
|
|
|
311 | (2) |
|
|
|
313 | (1) |
|
|
|
313 | (1) |
|
Other System Controller Security Issues |
|
|
314 | (7) |
|
|
|
314 | (1) |
|
dumpconfig and restoreconfig |
|
|
315 | (2) |
|
|
|
317 | (4) |
|
Recovering a Platform Administrator's Lost Password |
|
|
321 | (2) |
|
|
|
323 | (4) |
|
|
|
323 | (1) |
|
|
|
323 | (4) |
| Part VI. Solaris Security Toolkit Documentation |
|
|
|
|
327 | (10) |
|
|
|
328 | (2) |
|
|
|
328 | (1) |
|
|
|
329 | (1) |
|
|
|
330 | (3) |
|
|
|
330 | (1) |
|
|
|
331 | (2) |
|
|
|
333 | (1) |
|
Frequently Asked Questions |
|
|
334 | (2) |
|
|
|
336 | (1) |
|
Installation, Configuration, and User Guide |
|
|
337 | (28) |
|
|
|
338 | (1) |
|
|
|
338 | (2) |
|
|
|
339 | (1) |
|
JumpStart Technology Mode |
|
|
340 | (1) |
|
|
|
340 | (1) |
|
|
|
340 | (1) |
|
|
|
341 | (1) |
|
Installation and Basic Configuration |
|
|
341 | (1) |
|
|
|
341 | (15) |
|
driver.init Configuration File |
|
|
342 | (1) |
|
|
|
342 | (6) |
|
finish.init Configuration File |
|
|
348 | (7) |
|
user.init Configuration File |
|
|
355 | (1) |
|
Using the Solaris Security Toolkit |
|
|
356 | (5) |
|
|
|
356 | (2) |
|
|
|
358 | (3) |
|
|
|
361 | (3) |
|
|
|
364 | (1) |
|
|
|
365 | (40) |
|
Supported Solaris OE Versions |
|
|
366 | (1) |
|
|
|
366 | (1) |
|
|
|
367 | (1) |
|
|
|
367 | (10) |
|
|
|
367 | (2) |
|
|
|
369 | (8) |
|
|
|
377 | (5) |
|
The Jass_Files Environment Variables and Files Directory Setup |
|
|
377 | (2) |
|
|
|
379 | (3) |
|
|
|
382 | (17) |
|
|
|
382 | (1) |
|
|
|
383 | (7) |
|
|
|
390 | (3) |
|
|
|
393 | (1) |
|
|
|
393 | (2) |
|
|
|
395 | (1) |
|
|
|
395 | (3) |
|
|
|
398 | (1) |
|
|
|
399 | (1) |
|
|
|
400 | (1) |
|
|
|
400 | (1) |
|
|
|
401 | (1) |
|
|
|
401 | (1) |
|
Profile Configuration Files |
|
|
401 | (1) |
|
|
|
402 | (1) |
|
|
|
402 | (1) |
|
|
|
403 | (2) |
|
|
|
405 | (12) |
|
|
|
406 | (1) |
|
|
|
407 | (2) |
|
|
|
407 | (1) |
|
Jass_Config_Dir Variable Renamed |
|
|
407 | (1) |
|
Scripts* and Files* Prefix Conventions |
|
|
407 | (1) |
|
|
|
407 | (1) |
|
|
|
408 | (1) |
|
copy_files Function Enhanced |
|
|
408 | (1) |
|
New Configuration File finish.init |
|
|
408 | (1) |
|
|
|
409 | (1) |
|
|
|
409 | (1) |
|
Changes to Driver Scripts |
|
|
409 | (1) |
|
|
|
410 | (1) |
|
Changes to Finish Scripts |
|
|
411 | (2) |
|
|
|
411 | (1) |
|
Increased Partition Size Default |
|
|
411 | (1) |
|
Modified disable-system-accounts.fin |
|
|
411 | (1) |
|
Renamed disable-rlogin-rhosts.fin |
|
|
411 | (1) |
|
Updated install-strong-permissions.fin |
|
|
412 | (1) |
|
Removed EvilList Parameter Duplicates |
|
|
412 | (1) |
|
Improved Output Format for print-jass-environment.fin |
|
|
412 | (1) |
|
Symbolic Links Changed in set-system-umask.fin |
|
|
412 | (1) |
|
|
|
412 | (1) |
|
Preventing kill Scripts from Being Disabled |
|
|
413 | (1) |
|
|
|
413 | (1) |
|
|
|
414 | (3) |
|
Logging Changes to System Files |
|
|
414 | (1) |
|
Symbolic Links to Files and Directories |
|
|
414 | (1) |
|
Formatting Leading Slashes (/) |
|
|
414 | (1) |
|
Processing User Variables-Bug Fixed |
|
|
414 | (1) |
|
Removed add-client Directory Dependency |
|
|
414 | (1) |
|
Changed Default le0 Entry |
|
|
415 | (1) |
|
New Variable Jass_Hostname |
|
|
415 | (2) |
| Index |
|
417 | |
Shopping Cart
Need Help? eService@ecampus.com
Copyright© 1999-2008
