IMPORTANT: Review these tables carefully. Some locked-down services and protocols might be used by other applications and have adverse effects on the behavior or functionality of these applications. You can change these security settings after installing or updating your system.

Table A-2 Host-based Sec10Host, Sec20MngDMZ, and Sec30DMZ security settings

Category

Action

 

Deny login unless home directory exists

 

Deny non-root logins if /etc/nologin file exists

 

Set a default path for su command

Logins and passwords

Deny root logins from network tty

 

Hide encrypted passwords

 

Deny ftp system account logins

 

Deny remote X logins

 

 

 

Modify ndd settings1, 2

File system, network, and kernel

Restrict remote access to swlist

Set default umask

 

 

Enable kernel-based stack execute protection

 

 

 

Disable ptydaemon

 

Disable pwgrd

 

Disable rbootd

Daemons

Disable NFS client daemons

Disable NFS server

 

Disable NIS client programs

 

Disable NIS server programs

 

Disable SNMPD

 

 

 

Disable bootp

 

Disable inetd built-in services

 

Disable CDE helper services

 

Disable finger

 

Disable ident

 

Disable klogin and kshell

 

Disable ntalk

 

Disable login, shell, and exec services

inetd services

Disable swat

 

Disable printer

 

Disable recserv

 

Disable tftp

 

Disable time

 

Disable uucp

 

Disable Event Monitoring Services (EMS) network

 

communication

 

Enable logging for all inetd connections

sendmail

Other settings

Run sendmail via cron to process queue Stop sendmail from running in daemon mode Disable vrfy and expn commands

Disable HP Apache 2.x Web Server3 Set up cron job to run SWA1

28 Install-Time Security (ITS) using HP-UX Bastille