🚀 go-pugleaf

Maximum security? That's easy. Don't take it out of the box. :) :) :)

For something slightly less secure, take it out of the box, set it up,
  but don't plug it into the network. :) :) :)

	-Heiji
	 "I've been hacking all night, my brain is toast."


-- 
===========================================================================
 Mr. Heiji Horde    (Non NeXT mail only please)     e-mail: horde@reed.edu
   All insane acts are done in affiliation with Madd Hacker Enterprises
    "Don't explode in front of my parents, it wouldn't look good." - M.H.

horde@reed.edu (Mr. Heiji Horde) writes:

>Maximum security? That's easy. Don't take it out of the box. :) :) :)

>For something slightly less secure, take it out of the box, set it up,
>  but don't plug it into the network. :) :) :)

  It's very easy to ridicule somebody who wants to learn something. I
 think its better (and maybe more difficult) to give useful information
 than post some cliche....

  There are lots of places where you can find information about security.

 -- See Alex's monthly FAQ posting in this newsgroup.
 -- Another good place to look is cert.org. There are lots of interesting
    things you can ftp from there, e.g. old CERT advisories.
 -- There are some PD papers about security eg. the excellent security-doc
    by David Curry. Available from ftp.uu.net in the /doc/security directory.
    You can find more interesting things there.
 -- Books. See the FAQ. A good one is "Practical Unix Security" by Garfinkel
    andd Spafford.
 -- Contact your vendor for bugfixes. Some vendors make them available
    through anonymous ftp. If you have Suns, look at ftp.uu.net in the
    sun-fixes or sun-dist directory (/vendor/sun/...).

  Another tip I can give you is ...., read the (friendly) manual pages :-)
 Look what deamons are running on your system (using ps(1)). Also look at
 the ones that are started by inetd. Take a day to just read the manual
 pages that describe these daemons. Also read the ones in the SEE ALSO
 section. Now you should know all configuration files associated  with
 these daemons. Check them all. There are lots of them, and they are all
 important :-)  /etc/exports, /var/yp/securenets, /etc/shells, /etc/ftpusers
 /etc/netgroup, /etc/hosts.equiv to just name a few. Also look at all the
 possible flags of those daemons. Lots of them are important. -s flag of
 in.tftpd, -s flag of ypbind, the -n flag of rpc.mountd (do not use it !), 
 etc.
  Reading all those manual pages may take some time, but it will pay off.

  If you have Sun's, this might be another tip. Look at /etc/rc.local.
 A couple of times there are choices in starting up daemons (rpc.mountd,
 nfsd, etc..), depending on the existence of /etc/security. If you don't
 have the C2 security package installed, this directory does not exist.
  In this case those daemons are started up in a less secure mode.
 Change the checks in /etc/rc.local so the more secure mode is chosen.

    Hope this helps,

                 Henk.

--
Henk Smit                               Vrije Universiteit     Amsterdam
Internet: henk@cs.vu.nl                 Phone:    +31 20 548 6218

In article <1939@kluge.fiu.edu> sumargoh@fiu.edu writes:
>
>The subject said it all.  I believe that there is some publish guide line that I can
>download from some ftp sites.  Could someone give the pointer and send to 
>            sumargoh@serss0.fiu.edu
>
>Thanks a lot for the response.

I can give you some hints myself:
- Don't connect it to a network, don't connect modems or Ethernet
- Don't let anyone use it. If this is not desirable, let only those
  people use it who need to use it. Also enforce a policy for physical
  access control.
- Have a good passwd policy, force users to choose good passwords.
- Install all patches available, be sure you know what is fixed and
  what is unfixable.
- Put a good sysadmin in charge, not some tape-changing drone, but an
  interested hacker-like programmer-type user.

Rob
-- 
/-----------------------------------------------\			   ,==.
| Rob J. Nauta, UNIX computer security expert.	| 			  /@  |
| rob@wzv.win.tue.nl, Phone: +31-40-837549	| 			 /_  <
| Feel free to email me for free advice		|			=" `g'

In article <3731@wzv.win.tue.nl> rob@wzv.win.tue.nl (Rob J. Nauta) writes:
>In article <1939@kluge.fiu.edu> sumargoh@fiu.edu writes:
>>
>>The subject said it all.  I believe that there is some publish guide line that I can
>>download from some ftp sites.  Could someone give the pointer and send to 
>>            sumargoh@serss0.fiu.edu
>>
>>Thanks a lot for the response.
>
>I can give you some hints myself:
[...]
>- Put a good sysadmin in charge, not some tape-changing drone, but an
>  interested hacker-like programmer-type user.
>
>Rob
>-- 
someone like.....   ROB?   ;)

(quick someone get this man off the street)

In article <3731@wzv.win.tue.nl> rob@wzv.win.tue.nl (Rob J. Nauta) writes:
>In article <1939@kluge.fiu.edu> sumargoh@fiu.edu writes:
>>
>>The subject said it all.  I believe that there is some publish guide line that I can
>>download from some ftp sites.  Could someone give the pointer and send to 
>>            sumargoh@serss0.fiu.edu
>>
>>Thanks a lot for the response.
>
>I can give you some hints myself:
>- Don't connect it to a network, don't connect modems or Ethernet
   
Or at least use dial-out only connections with uucp (and pos cu) only,
and only allow a very limited range of commands (rmail and rnews making
sure you have set news and mail up well) on the uucp link.

>- Don't let anyone use it. If this is not desirable, let only those
>  people use it who need to use it. Also enforce a policy for physical
>  access control.
>- Have a good passwd policy, force users to choose good passwords.
>- Install all patches available, be sure you know what is fixed and
>  what is unfixable.
>- Put a good sysadmin in charge, not some tape-changing drone, but an
>  interested hacker-like programmer-type user.

All the rest is spot on.

Damon
-- 
Damon Hart-Davis | Tel/Fax: +44 81 755 0077 |1.22|| ALL MAIL FREE.
Internet: dhd@exnet.co.uk | Also: Damon@ed.ac.uk || US hotrod motor groups.
--------------------------+----------------------++ >12 mail&news polls / day.
Public access UNIX (Suns), news and mail for #5 per month.  FIRST MONTH FREE.

In article <1992Aug16.164237.25937@reed.edu> horde@reed.edu (Mr. Heiji Horde) writes:
>Maximum security? That's easy. Don't take it out of the box. :) :) :)
>
>For something slightly less secure, take it out of the box, set it up,
>  but don't plug it into the network. :) :) :)
>
>	-Heiji
>	 "I've been hacking all night, my brain is toast."

This is especially bad at 3am, when you accidently shove a job into the back-
ground, try to kill it, and kill init instead :) :)

Seriously, I have book by the O' Reily people called "Practical Unix Security"
that is an excellent book for setting up a machine that is reasonably secure.

-pmm

-- 
Paul M. Mickel				Internet:mickel@oes.orst.edu
Oregon State University                 UUCP: ...hplabs!orstext!mickel
Corvallis, OR 97331   USA               #include <stddisclaimer.h>