HP UX Bastille Software AccountSecurity.root_path, AccountSecurity.restrict_home, AccountSecurity.passwordpolicies, AccountSecurity.serial_port_login

Description	This parameter controls the default number of days before password expiration
	that a user is warned that the password must be changed. For systems running
	HP-UX 11.11 and HP-UX 11.0, setting this value requires conversion to trusted
	mode. For HP-UX 11.22 and later, shadowed password conversion is required.
	This parameter applies only to local non-root users.
Actions	Sets the parameter PASSWORD_WARNDAYS in the /etc/default/security
	file.

AccountSecurity.passwordpolicies

Headline	Set up password policies.
Default	N
Description	Set up password policies.
Actions	None.

AccountSecurity.restrict_home

Headline	Restrict the home directory permissions.
Default	N
Description	Home directories should not be world-writable or world-readable. This item
	removes world-visibility and group-write from the local account directories,
	similar to executing chmod o-rwx,g-w <dir>.
Actions	Remove world visibility and group write from the local account home
	directories, similar to executing chmod o-rwx,g-w <home dir>.

AccountSecurity.root_path

Headline	Remove the dot from the root path.
Default	N
Description	A dot in the root path instructs the shell to look in the current directory for
	an executable. This can cause a local command to either override a common
	administrative command, or cause an incorrectly typed command to execute
	a local command. This allows malicious users to plant rogue commands that
	could potentially run malicious software as root. This item removes the current
	working directory, "dot" from the root path startup scripts.
Actions	Remove the current working directory "." or any group/world-writable
	directory from the root $PATH.

AccountSecurity.serial_port_login

Headline	Disable all serial ports except the console.
Default	Y
Description	The ability to login on a serial port except the console is a rare need.
	Historically, these were used for terminal devices or modems, but it is unlikely
	that a site would need this capability. This item turns off the process that
	listens to the tty devices.
Actions	Comment out serial port tty entries in the /etc/inittab file and invoke
	init to reread the file.

AccountSecurity.single_user_password

Headline	Password protect single-user mode.
Default	N
Description	Password protecting single-user mode provides limited protection against
	anyone who has physical access to the machine, because they cannot reboot
	and have root access without typing the password. However, if an attacker

37