B Configuring HP-UX Bastille for use with Serviceguard

B.1 Configuring Sec20MngDMZ or Sec30DMZ security levels

Serviceguard uses dynamic ports. To enable operation, the possible-SG port range must be opened. Opening the port range is not consistent with the security goals of Sec20MngDMZ MANDMZ.config and Sec30DMZ DMZ.config because multiple services (including applications similar to rcp), might also listen to this same port range. At these security levels, the firewall provides security benefits consistent with the Serviceguard security deployment model.

For more information about HP-UX Bastille compatibility with Serviceguard, see the Serviceguard documentation available at:

http://docs.hp.com/en/netsys.html.

Before you open the Serviceguard port range, review the required IPFilter-SG rules. IPFilter documentation is available at:

http://docs.hp.com/en/internet.html

When the Serviceguard security patch of 2004 is installed, Serviceguard requires identd. To enable identd:

1.Edit the HP-UX Bastille /etc/opt/sec_mgmt/bastille/config configuration file by changing the answer to the question:

Should Bastille ensure inetd's ident service does not run on this system?

Change the answer from Y to N.

SecureInetd.deactivate_ident=N

2.Apply the configuration file changes.

•If you have not made any configuration changes to the system since the last time HP-UX Bastille was used, use HP-UX Bastille to apply the changes.

a.Revert to the previous HP-UX Bastille configuration:

#bastille -r

b.Apply the new HP-UX Bastille configuration:

#bastille -b

•If the you have applied configuration changes to the system since the last time HP-UX Bastille was used, apply the changes manually.

a.Remove the # from the /etc/inetd.conf file line:

#auth stream tcp6 wait bin /usr/lbin/identd identd

b.Force inetd to read the configuration:

#inetd -c

B.2 Configuring Sec10Host level

If HP-UX Bastille is started using Sec10Host host.config level security, change the following line:

SecureInetd.deactivate_ident=Y

Change the Y to N:

SecureInetd.deactivate_ident=N

If you are using the Serviceguard SNMP subagent, set:

MiscellaneousDaemons.snmpd=N

B.1 Configuring Sec20MngDMZ or Sec30DMZ security levels 31