[Go up]
Security checklist on SGI
Borrowed from http://www.sgi.com/Archive/FAQs/security/003.html
1. Several accounts come without passwords, including (but not limited to)
guest, 4Dgifts, demos, tutor, tour and particularly lp. Examine /etc/passwd
and lock all unnecessarily open accounts. Note that 1) parts of IRIX (e.g.
'inst') use the open guest account by default, and 2) remote 'lp' clients need
access to the lp account to print, so you'll need to make other arrangements.
#!/bin/sh
for account in `/bin/passwd -sa | /sur/bin/awk '$2 == "NP" {print $1}'`
do
/bin/echo Locked the $account account
/bin/passwd -l $account
done
The above script can be used to lock all accounts without a password.
The procedure will also work if shadow passwords are used.
2. 'xdm' does 'xhost +' by default when you log in. This allows anyone to open
windows on your display and even to record what you type at your keyboard. Close
this hole by removing the 'xhost +' from /usr/lib/X11/xdm/Xsession,
/usr/lib/X11/xdm/Xsession-remote and (in IRIX 5.x) /usr/lib/X11/xdm/Xsession.dt.
In IRIX 5.2 and later you can use X authorization to control access to remote
displays; see below. In IRIX 5.1.x and earlier X authorization doesn't work, so
you'll need to use 'xhost' judiciously to get to remote displays: say 'xhost
+localhost' to run DGL programs and 'xhost +otherhost' to display remote X
programs.
3. At least some of the possible default values of the PATH environment variablebegin with
the current directory. (The system interprets either a period or the
empty string in any component of PATH as the current directory. PATH is
colon-separated, so if it begins with a colon the first component is the empty
string.) This exposes you to Trojan horse programs. Set PATH to a safe value
(remove the current directory, or at least move it to the end) in
/etc/cshrc and/or /etc/profile for regular users and /.login for root.
4. By default, /etc/config/ypbind.options contains the -ypsetme option. This
allows someone who can fake your IP address to change your YP binding. Remove
the -ypsetme option to close the hole and add the -s option for a little extra
protection. Comment out the invocations of 'ypset' in /var/yp/make.script and
/var/yp/ypmake to avoid error messages. If your site runs ypbind with the -v
(verbose) option, you may also want to add 'YPSET=true' to /etc/config/ypmaster
options and comment out the 'ypset' line in /var/yp/ypmake. See the ypbind(1)
and ypset(1) manpages for more.
5. If you use SLIP (see slip(1M)), be sure that SLIP accounts' home directories
are not world-writable. SLIP accounts are uid 0, so it's bad if just anyone can
mess with their .forward files and the like. /tmp, which is recommended in the
"IRIX Advanced Site and Server Administration Guide", is necessarily world-
writable and a bad choice. You may want to make an empty, root-owned, mode 755
directory to the effect of /usr/slip and use that. Any number of SLIP accounts
can use a single home directory without conflict.
6. Add '-a' to the rlogind and rshd lines in /etc/inetd.conf to require remote
hostnames and addresses to match. You *might* want to disallow .rhosts files
by adding the '-l' flag as well, but this removes real functionality and should
not be done without reason. See the rlogind(1M) and rshd(1M) manpages. Note that
rlogind's '-l' flag does not work in IRIX 5.2. It does work in IRIX 5.3.
7. The default root crontab in current IRIXes (/var/spool/cron/crontabs/root)
creates the SYSLOG and cron log with group and world read permission. Change the
'033' on lines 25 and 27 to '077' to prevent non-superusers from reading these
files.
8. By default, xdm looks for X terminal login requests on port 177. This is no
different (for security purposes) than allowing rlogin or telnet connections,
but it might be undesirable in some environments. Edit /var/X11/xdm/Xaccess to
restrict this access, e.g. by placing a `!' in front of each of the two lines
which begin with an asterisk to prevent all XDMCP requests.
9. /etc/init.d/rmtmpfiles resets the permissions on /tmp and /var/tmp at every
bootup. By default, permissions are set to 1777; the '1' means sticky, so one
user can't remove another's temporary files. If one does 'chkconfig
nostickytmp on', permissions are set to 777 and any user can remove another's
temporary files. Don't do this: it allows a variety of attacks involving race
conditions in setuid programs. A related class of attacks is described in
ftp://ciac.llnl.gov/pub/ciac/bulletin/f-27.permissions-on-tmp.asc, but note
that Sun's tmpfs is not an essential component of the hole.
10. Non-root users can give away files. This can be used to defeat accounting
and quotas. Set the 'restricted_chown' kernel variable to 1 to allow only root
to give away files. This may break some programs which depend on unrestricted
chown, e.g. /bin/mail (when delivering to an NFS volume without root access) as
discussed in the admin FAQ. (Thanks to Jonathan Rozes for this and the next
item.)
11. NFS connections to unprivileged ports are accepted by default. Set the
'nfs_portmon' kernel variable to 1 to reject NFS connections to unprivileged
ports.
12. /etc/inetd.conf enables some unnecessary services. The 'echo' and 'chargen' services can
allow a denial-of-service attack, as described, for example, in
CERT advisory CA-96.01, at ftp://ftp.cert.org/pub/cert_advisories/CA-96.01.UDP_
service_denial. To disable those particular services, comment out the lines
which begin with their names in /etc/inetd.conf and 'killall -HUP inetd'. You
may want to disable other unused UDP-based services as well.
13. Many devices have permissions which might allow a user to monitor another
user via audio or video input, including
/dev/audio /dev/dmrb /dev/hdsp/* /dev/vid /dev/video
Bill Paul 's solution is to add the following to /usr/lib/X11/xdm/Xstartup:
chmod 600 /dev/audio /dev/hdsp/* /dev/video /dev/vid /dev/dmrb chown $USER
/dev/audio /dev/hdsp/* /dev/video /dev/vid /dev/dmrb
and the following to /usr/lib/X11/xdm/Xreset:
chmod 600 /dev/audio /dev/hdsp/* /dev/video /dev/vid /dev/dmrb chown root
/dev/audio /dev/hdsp/* /dev/video /dev/vid /dev/dmrb
(Simon ? pointed out that the chmod should precede the chown to avoid a race condition.)
14. If you are not using shadow passwords, turn it on. Run "pwconv" to move your
passwords to /etc/shadow, where only root can read them. Note that you'll have
to update /etc/shadow by hand for NIS users.
15. Limit the hosts from which portmap(1M) adn rpcbind(1M) will accpet RPC
requests by using the -a option in /etc/config/portmap.options. For example, if
your machine is www.xxx.yyy.zzz and your subnet is www.xxx.yyy, you can reject
RPC requests from outside your subnet by putting '-a 255.255.255.0 www.xxx.yyy.0
' in that file. Despite the file's name and the absence of any options in the
rpcbind manpage, this appears to work with rpcbind as well as portmap.
16. Log more information about logins.
- 'last', 'who', etc get remote login information from /var/adm/upmpx
and /var/adm/wtmp. That information is only logged into these files. if they
already exist. To create them, do 'touch /var/adm/utmpx /var/adm/wtmpx'
-As described in the login(1) manpage, you can change the line
"SYSLOG=FAIL' in /etc/default/login to 'SYSLOG=ALL' to log all login attempts,
not just succesfful ones, in /var/adm/SYSLOG. The same change in /etc/default/su
has the same effect on 'su' attempts.
- 'ftpd', 'rshd', 'tftpd' and 'fingerd' all have options ('-l' or '-L')
which cause them to log all access. 'ftpd' also has '-ll' and '-lll' options
which log individual file transfers and the sizes of those files respectively
Add the options to the last fields of the appropriate lines of /etc/inetd.conf,
the do 'killall -HUP inetd' or reboot.
- Using tcp wrappers. This allows you not only to log most types of
connections, but to restrict connections from particular hosts and prevent some
forms of address spoofing.
17. Make sure that each user's home account, and especially the shell-startup
files .profile , or .login and .cshrc, are writable only by that user. This ensures that
"trojan horse" programs are not insertned in a user's login files.
18. Besure that system directories such as /, /bin, /usr/bin, and /etc and the
files in them are not writable except by the owner. This also prevents trojan
horse attacks.
19. If a login is not used or needed, disable(lock) the login. Use the followingcommand.
passwd -l jones.
20. Restricting root logins. You can restrict root logins to a single device,
forcing root users to either use that device or use the su command (thereby
leaving a trail in /var/adm /sulog) Edit /etc/default/login to include the
following line to restrict root logins to the system console:
CONSOLE=/dev/console. Note: Do not name /dev/syscon or /dev/systty as the
device!
[UNIX Admins Home Page | Computing & Telecommunications]
University of Nevada, Reno
Maintained by: unixwebadmin@unr.edu.
Last Modified: October 1, 1998