 Print-friendly Version
Hardened Build Example for the Solaris 9 OSRoss Moffatt, March 2007 Contents
OverviewI decided to publish this example build as there are a number of questions along the lines of "How do I harden my host?" A couple of utilities are available, but if you really want to see what is involved to harden a host, read on. The information in this article has mainly come from the Sun host hardening utility, Solaris Security Toolkit. This build is designed as a hardened build of the Solaris platform, with mirroring. As a result, the build ends up quite small, under 200MB. The philosophy behind this build is:
Of course this means the server is unfriendly. You will have no man pages, no mail, only ssh available for remote login, no inetd running, and generally This build was done on a Sun Fire V120 server with two 36G drives and 1G of memory, partitioned as follows:
/ 1 GB
swap 2 GB
/usr 1 GB
/var 20 GB
/var/crash 3 GB
/opt 7.4 GB
unassigned 16 MB
The installation will then be hardened. The hardening process includes stopping unused components from running, editing the configuration of components that are running, and changing permissions of files/directories. Host detail required: Host Name <hostname> IP Address <ipaddress> Netmask <netmask> Default Router <defaultrouter> DNS Domain <dnsdomain> Primary Nameserver <nameserver1> Secondary Nameserver <nameserver2> Primary time server <timeserver1> Secondary time server <timeserver2> CD-ROM list: Solaris 9 9/05 Software CD 1, English Solaris 9 9/05 Software CD 2, English Initial Solaris Boot and InstallPower on the CD-ROM drive and any other external peripherals, including the console. Power on the machine. Open the CD-ROM tray, and insert the "Solaris 9 9/05 Software 1 of 2" CD. From the console: Interrupt the boot and get to the ok prompt. Note: Screen output has been edited. Disable keyboard abort.
Edit Uncomment the following line: #KEYBOARD_ABORT=disable Save the file then reread the file. kbd -i Root environment setup Log in as root. Change the root account password. passwd root Create the root user's profile. TERM=vt100;export TERM mkdir roothome cd roothome vi .profile Create this file as follows.
Note: If you have your own
stty erase \^h
l() { ls -la $* | more ; }
ll() { ls -la $* ; }
EDITOR=vi;export EDITOR
FCEDIT=vi;export FCEDIT
TERM=vt100;export TERM
DISPLAY=`who -m | cut -c 39- | cut -d\) -f 1`:0.0
export DISPLAY
# Reset prompt for superuser
#
PS1="`hostname`/$LOGNAME # "
export PS1
echo "WARNING: YOU ARE SUPERUSER !!\n
Add a user, suser, to the password and shadow files. vi /etc/passwd Edit the file to look like this: root:x:0:1:Super-User:/superuser:/sbin/sh daemon:x:1:1::/: bin:x:2:2::/usr/bin: sys:x:3:3::/: adm:x:4:4:Admin:/var/adm: lp:x:71:8:Line Printer Admin:/usr/spool/lp: uucp:x:5:5:uucp Admin:/usr/lib/uucp: nuucp:x:9:9:uucp Admin:/var/spool/uucppublic:/usr/lib/uucp/uucico smmsp:x:25:25:SendMail Message Submission Program:/: listen:x:37:4:Network Admin:/usr/net/nls: suser:x:500:10:Super-user:/roothome:/sbin/sh nobody:x:60001:60001:Nobody:/: noaccess:x:60002:60002:No Access User:/: nobody4:x:65534:65534:SunOS 4.x Nobody:/: Save the file, then do the following: vi /etc/shadow Edit the file to look like this: root:aabbccddee:13403:::::: daemon:*LK*:6445:::::: bin:*LK*:6445:::::: sys:*LK*:6445:::::: adm:*LK*:6445:::::: lp:*LK*:6445:::::: uucp:*LK*:6445:::::: nuucp:*LK*:6445:::::: smmsp:*LK*:6445:::::: suser::13403:::::: listen:*LK*::::::: nobody:*LK*:6445:::::: noaccess:*LK*:6445:::::: nobody4:*LK*:6445:::::: Save the file, then do the following: vi /etc/group Edit the file to look like this: root::0:root other::1: bin::2:root,bin,daemon sys::3:root,bin,sys,adm adm::4:root,adm,daemon uucp::5:root,uucp mail::6:root tty::7:root,adm lp::8:root,lp,adm nuucp::9:root,nuucp staff::10: daemon::12:root,daemon sysadmin::14: smmsp::25:smmsp nobody::60001: noaccess::60002: nogroup::65534:
Use the Installing Extra Packages Load the following packages from the Software 1 of 2 CD. mkdir /cdrom mount -F hsfs -r /dev/dsk/c0t0d0s0 /cdrom cd /cdrom/Solaris_9/Product pkgadd -d . SUNWxwfnt SUNWi1of SUNWlibC SUNWlibCx SUNWadmr pkgadd -d . SUNWadmfw SUNWadmc SUNWdtcor SUNWuxflr.u SUNWuxflu.u cd umount /cdrom Load the following packages from the Software 2 of 2 CD. mount -F hsfs -r /dev/dsk/c0t0d0s0 /cdrom cd /cdrom/Solaris_9/Product pkgadd -d . SUNWaccu SUNWsshcu SUNWsshdr SUNWsshdu SUNWsshr SUNWsshu cd umount /cdrom
Download cd /tmp zcat SunExplorer.tar.Z | tar -xf - pkgadd -d . SUNWexplo SUNWexplu Here is the list of packages installed. Mirror the DisksSet up partitions on disks. prtvtoc /dev/rdsk/c1t0d0s2 | fmthard -s - /dev/rdsk/c1t1d0s2 Create the state database replicas. metadb -a -f -c 3 /dev/dsk/c1t0d0s7 metadb -a -c 3 /dev/dsk/c1t1d0s7
Create the submirrors for the metainit -f d10 1 1 c1t0d0s0 d10: Concat/Stripe is setup metainit -f d20 1 1 c1t1d0s0 d20: Concat/Stripe is setup metainit d0 -m d10 d0: Mirror is setup Update the root to be the mirror.
Update vi /etc/vfstab Change from this: #device device mount FS fsck mount mount #to mount to fsck point type pass at boot options # fd - /dev/fd fd - no - /proc - /proc proc - no - /dev/dsk/c1t0d0s1 - - swap - no - /dev/md/dsk/d0 /dev/md/rdsk/d0 / ufs 1 no - /dev/dsk/c1t0d0s3 /dev/rdsk/c1t0d0s3 /usr ufs 1 no - /dev/dsk/c1t0d0s4 /dev/rdsk/c1t0d0s4 /var ufs 1 no - /dev/dsk/c1t0d0s5 /dev/rdsk/c1t0d0s5 /var/crash ufs 2 yes - /dev/dsk/c1t0d0s6 /dev/rdsk/c1t0d0s6 /opt ufs 2 yes - swap - /tmp tmpfs - yes - Change to this: #device device mount FS fsck mount mount #to mount to fsck point type pass at boot options # fd - /dev/fd fd - no - /proc - /proc proc - no - /dev/md/dsk/d1 - - swap - no - /dev/md/dsk/d0 /dev/md/rdsk/d0 / ufs 1 no - /dev/md/dsk/d3 /dev/md/rdsk/d3 /usr ufs 1 no - /dev/md/dsk/d4 /dev/md/rdsk/d4 /var ufs 1 no - /dev/md/dsk/d5 /dev/md/rdsk/d5 /var/crash ufs 2 yes - /dev/md/dsk/d6 /dev/md/rdsk/d6 /opt ufs 2 yes - swap - /tmp tmpfs - yes - Do the following: init 6 Attaching the Mirrors metattach d0 d20 d0: submirror d20 is attached metattach d1 d21 d1: submirror d21 is attached metattach d3 d23 d3: submirror d23 is attached metattach d4 d24 d4: submirror d24 is attached metattach d5 d25 d5: submirror d25 is attached metattach d6 d26 d5: submirror d25 is attached
Use metastat Edit the system file so the system will boot even if only one boot disk is available. echo "set md:mirrored_root_flag=1" >> /etc/system Operating System Configuration
dumpadm -d /dev/md/dsk/d1
Dump content: kernel pages
Dump device: /dev/md/dsk/d1 (swap)
Savecore directory: /var/crash/<hostname>
Savecore enabled: yes
mkdir /etc/ntp
vi /etc/inet/ntp.conf
Create this file as follows. server <timeserver1> key 0 prefer server <timeserver2> key 0 Check and/or patch the server firmware. Download the latest OpenBoot PROM (OBP) patch, unpack, and follow the installation instructions. Patch the installation. mkdir /var/tmp/sol9patches cd /var/tmp/sol9patches ftp <somewhere> ftp> bi ftp> get 9_SunAlert_Patch_Cluster.zip ftp> bye unzip * cd 9_SunAlert_Patch_Cluster ../install_cluster init 6 Harden the InstallationStop functions from starting on boot (as root). mv /etc/rc2.d/S72autoinstall /etc/rc2.d/K72autoinstall mv /etc/rc2.d/S71sysid.sys /etc/rc2.d/K71sysid.sys mv /etc/rc2.d/S30sysid.net /etc/rc2.d/K30sysid.net mv /etc/rc3.d/S15nfs.server /etc/rc3.d/K15nfs.server mv /etc/rc2.d/S89PRESERVE /etc/rc2.d/K89PRESERVE mv /etc/rc2.d/S71ldap.client /etc/rc2.d/K71ldap.client mv /etc/rc2.d/S72inetsvc /etc/rc2.d/K72inetsvc mv /etc/rc2.d/S71rpc /etc/rc2.d/K71rpc mv /etc/rc2.d/S73nfs.client /etc/rc2.d/K73nfs.client Add functions to start on boot. vi /etc/rc2.d/S73swapadd Create this file as follows. Save the file. chmod 744 /etc/rc2.d/S73swapadd vi /etc/init.d/nddconfig Create this file as follows. Here are the next steps: chmod 744 /etc/init.d/nddconfig chown root:sys /etc/init.d/nddconfig ln /etc/init.d/nddconfig /etc/rc2.d/S70nddconfig Configuration files to modify (as root): vi /etc/default/keyserv Change the following line from: #ENABLE_NOBODY_KEYS=YES to: ENABLE_NOBODY_KEYS=NO Do the following: vi /etc/cron.d/cron.deny Add the following line: lp Here's the next step: vi /etc/nscd.conf Edit the file to look like this: vi /etc/default/login Uncomment the following line: CONSOLE=/dev/console vi /etc/pam.conf Edit the file to look like this: Save the file, then do the following: rm /etc/inetd.conf touch /etc/inetd.conf vi /etc/logadm.conf Change /var/cron/log -c -s 512k -t /var/cron/olog to /var/cron/log -c -s 10240k -t /var/cron/olog Save the file, then do the following: vi /etc/default/inetinit Change the line TCP_STRONG_ISS=1 to TCP_STRONG_ISS=2 Do the following: echo "set sys:coredumpsize=0" >> /etc/system echo "set noexec_user_stack=1" >> /etc/system echo "set noexec_user_stack_log=1" >> /etc/system rm /etc/cron.d/at.allow touch /etc/cron.d/at.allow vi /etc/cron.d/at.deny Edit the file to look like this: root daemon bin sys adm lp uucp smmsp suser sonnet nobody noaccess smtp nuucp listen
Save the file, then do the following: vi /etc/cron.d/cron.allow Edit the file to look like this: root adm Save the file, then do the following: vi /etc/cron.d/cron.deny Edit the file to look like this: daemon bin sys lp uucp smmsp suser nobody noaccess smtp nuucp listen Save the file, then do the following: vi /etc/default/inetd Change the following line from: #ENABLE_TCPWRAPPERS=NO to: ENABLE_TCPWRAPPERS=YES Save the file, then do the following: vi /etc/ssh/sshd_config Uncomment the following line: Banner /etc/issue Set default term to vt100. vi /etc/profile Change the following lines from:
if [ "$TERM" = "" ]
then
if /bin/i386
then
TERM=sun-color
else
TERM=sun
fi
export TERM
fi
to: TERM=vt100 export TERM Save the file, then do the following: vi /etc/.login Change the following lines from:
if ( $?TERM == 0 ) then
if { /bin/i386 } then
setenv TERM sun-color
else
setenv TERM sun
endif
else
if ( $TERM == "" ) then
if { /bin/i386 } then
setenv TERM sun-color
else
setenv TERM sun
endif
endif
endif
to: TERM=vt100 export TERM Save the file, then do the following: vi /etc/.login Check that the following line exists, or add it to the beginning of the file. umask 022 Do the following: vi /etc/profile Check that the following line exists, or add it to the beginning of the file. umask 022 Do the following: vi /etc/skel/local.cshrc Check that the following line exists, or add it to the beginning of the file. umask 022 Do the following: vi /etc/skel/local.login Check that the following line exists, or add it to the beginning of the file. umask 022 Do the following: vi /etc/skel/local.profile Check that the following line exists, or add it to the beginning of the file. umask 022
Uncomment the vi /etc/default/login Uncomment the following line: UMASK=022 Here are configuration files to create (as root): touch /noautoshutdown Disable IPv4/IPv6 routing. touch /etc/notrouter Define what shells can be used on the system. vi /etc/shells Create this file as follows: /usr/bin/sh /usr/bin/csh /usr/bin/ksh /usr/bin/jsh /bin/sh /bin/csh /bin/ksh /bin/jsh /sbin/sh /sbin/jsh /bin/pfcsh /bin/pfksh /bin/pfsh /usr/bin/pfcsh /usr/bin/pfksh /usr/bin/pfsh Save the file. vi /etc/issue Create this file as follows: Authorized Use Only |-----------------------------------------------------------------| | This system is for the use of authorized users only. | | Individuals using this computer system without authority, or in | | excess of their authority, are subject to having all of their | | activities on this system monitored and recorded by system | | personnel. | | | | In the course of monitoring individuals improperly using this | | system, or in the course of system maintenance, the activities | | of authorized users may also be monitored. | | | | Anyone using this system expressly consents to such monitoring | | and is advised that if such monitoring reveals possible | | evidence of criminal activity, system personnel may provide the | | evidence of such monitoring to law enforcement officials. | |-----------------------------------------------------------------| File permissions to change as root. Review files with vulnerable permissions.
Make
Edit vi /etc/vfstab /dev/md/dsk/d3 /dev/md/rdsk/d3 /usr ufs 1 no ro Reboot the host for this change to take effect. init 6 Set up OBP command protection. Note: This needs to be run only once to install on the Boot PROM. eeprom "security-#badlogins=3" eeprom "security-mode=command" Changing PROM password: New password: ###### Retype new password: ###### About the AuthorRoss Moffatt has been a UNIX System Administrator for more than 10 years and can be contacted at ross.stuff [at] telstra.com. Unless otherwise licensed, code in all technical manuals herein (including articles, FAQs, samples) is provided under this License. |
 
BigAdmin SubscriptionsBigAdmin Areas
BigAdmin Sun Center
BigAdmin Topics | |||
 | |
