Securing IRIX 6.5.5 on an SGI O2 May apply to other versions of IRIX or other types of hardware. You'll need to download the latest maintenance release of IRIX. For us the latest release is 6.5.13. I extracted the huge file and burned the resulting files on two cds. This way we don't have to connect the SGI to the network. Next you'll need to copy atleast one of the cds to the harddrive. Next click on the System menu in the Toolchest, select Software Manager. Next in the "Available Software" box type in the directory that you copied the cd(s) to (eg:/irix). Also if you only copied one of the cds to disk, insert the other cd and then type it's location in there as well (eg: it will look like "/irix /CDROM"). Next click on the Lookup button, then click on the Customize Installation. Software Manager should then give you a list of conflicts (we had 114). Next click on the File menu and select Open Additional Distribution. Click on the Eject button, insert the first IRIX installation disk numbered 100, then select /CDROM/dist and click on add. Go through these steps for the rest of the installation cds. Once you have added all the installation cds, click on Done. You should have about 8 conflicts. Next, click on Install and then select Switch to Maintenance Stream. Resolve the conflics, when you have no conflicts left click on the Start button. The installation procedure will ask you for various cds throughout the process so stay by the computer. When it is done it will ask if you want to reboot, reboot the computer. Next log in as root then in a terminal window type uname -R and verify that you are running the latest kernel. Next click on the System menu in the Toolchest, then select System Manager. Then click on Security and Access Control, then click on Improve System Security. Click on next, then give root a password and click on Accept. Next lock every account that you do not need (we locked everything but root). The next page is about Java and JavaScript. This page is a personal preference but we left it enabled for all users (note if you have not run netscape as the users and you try to disable Java and JavaScript, the Improve System Security Application will complain). The next page is about NIS, if you don't use it then select Yes to Remove NIS accounts, click next. The next page is about the shadow password file. If you don't use NIS then click on Yes to Use shadow password file and click next. Next click yes to Require passwords at login, click next. The next page is about disabling the visual login screen, it's up to you. Next disable privileged users is up to you. Next we chose Yes to Protect new users's files. Next definitely choose Yes to Disable remote display. Choose Yes to Disable IP forwarding. The Disable Outbox Web Server is already select as yes so click next. Now click ok to finish. It will then ask if you want to restart, choose yes. If it doesn't restart on it's own then choose Restart from the Toolchest->System menu. Now we are going to remove unecessary users. Once the system has rebooted, login as root. Open up the System Manager by clicking on System in the Toolchest. Then click on Security and Access Control. Next click on Remove a User Account. We chose to remove the files for each account. The accounts we removed are 4Dgifts, EZsetup, OutOfBox, cmwlogin, demos, guest. Next turn off all unneeded services in /etc/inetd.conf. The only lines I had uncommented are sgi_fam/1-2 tcpmux/sgi_printer tcpmux/sgi_sysadm tcpmux/sgi_dmusrcmd Next use chkconfig to turn off any unneeded services. The services I had left on are: desktop esp mediad network nsd rtmond savecore sesdaemon soundscheme sysevent visuallogin windowsystem xdm Next we'll install the firewall that comes with IRIX. Insert the cd with your latest maintenance release (it should have a file similar to eoe_6513m.sw on it). Next open up Software Manager. Then find the IRIX Execution Environment, select the folder icon next to it to expand it. Then select IP Network Gateway Support by clicking on the box next to it. If the conflicts button is red now, click on it. Choose to install eoe.sw.ipgate from another distribution or cd. Eject the current cd and insert the IRIX 6.5 Foundation 1 CD then select /CDROM/dist and click add. Now click start. Next do a echo "on" > /etc/config/ipfilterd Next edit /etc/ipfilterd.conf, some lines that you want in there are: #####START######## # Allow localhost connections accept -i localhost src=127.0.0.1 # Deny nonlocalhost connections from 127.0.0.1 reject src=127.0.0.1 # Allow dns replies, modify for your dns accept udp.sport=53 and ip.src=10.0.0.10 accept udp.sport=53 and ip.src=10.10.0.10 # Allow all tcp packets related to outgoing connections accept tcp and not(tcp.flags=SYN) # Reject everything else reject tcp reject udp accept icmp #######END######## If you need to allow any other ports, use the lines for dns as an example. Next we'll setup networking. Open System Manager under System in the Toolchest and click on Networking and Connectivity. Click on Network Interface Manager and double click on the interface. Double click on Set Up and Start Networking. Enter the appropriate information for the interface. Next click on Modify Network settings. Fill in the appropriate settings. Don't forget to add a default route. To prevent any system from obtaining a login window, replace the initial two lines that start with a * in /var/X11/xdm/Xaccess to !* Now reboot the system. Note, my system was unable to start up here. I had to go into the command monitor and execute resetenv. Next we'll upgrade/install freeware software. Open netscape (Toolchest->Internet->Open Web Browser) and goto http://freeware.sgi.com. Upgrade/install necessary software. Restart your computer and that should be it.