1Manual action may be required to complete configuration. For more information, see /etc/opt/sec_mgmt/ bastille/TODO.txt after update or installation.
2The following ndd changes are made:
ip_forward_directed_broadcasts=0 ip_forward_src_routed=0 ip_forwarding=0 ip_ire_gw_probe=0 ip_pmtu_strategy=1 ip_send_source_quench=0 tcp_conn_request_max=4096 tcp_syn_rcvd_max=1000
3Settings applied only if software is installed.
Table A-3 Additional Sec20MngDMZ security settings1
Category
inetd services
IPFilter configuration2
Action
Includes all disabled inetd services in Table
Disable telnet
Restrict syslog daemon to local connections
Block incoming DNS query connections
Block incoming HIDS administration connections3, 4 Configure IPFilter to allow outbound traffic Configure IPFilter to block incoming traffic with IP options set
Configure IPFilter to block all other traffic except for
1Applies all security configuration settings in Table
2Additional IPFilter rules may be applied with a custom rules file located at /etc/opt/sec_mgmt/bastille/
ipf.customrules.
3
4 Settings applied only if software is installed.
5 Manual action may be required to complete configuration. For more information, see /var/opt/sec_mgmt/ bastille/TODO.txt after installation or update.
Table A-4 Additional Sec30DMZ security settings1
Category
IPFilter configuration2
Action
Includes all IPFilter settings in Table
Block incoming web admin autostart connections Block all traffic except
1Applies all security configuration settings in Table
2Additional IPFilter rules may be applied with a custom rules file located at /etc/opt/sec_mgmt/bastille/
ipf.customrules.
3Settings applied only if software is installed.
4
5WBEM is required for several HP management applications including HP Systems Insight Manager (SIM) and ParMgr.
A.1 Choosing security levels | 29 |