U
Keep the cyberpunks out!
Keep CyberPunks OUT of your Solaris box!
By now everyone has been reading about the recent
breakins, credit card thefts, web server defacements,
and other malicious acts plaguing computers around
the world. It seems that computer crime is on the
rise and you simply can not afford to be complacent
any more.
Todays tip is where to find information about how
to "wrap a titanium turtle shell around your Solaris
box". If you already have acquired some basic command
line skills, and limited system administration skills
on your Solaris machine, you are ready to use this
information to make it significantly tougher for the
"bad guys" to bother your machine.
The good friends over at Sabernet have a great
little article at http://www.sabernet.net/papers/Solaris.html
which outlines simple configuration changes that will
help protect your system. Sabernet is a web site
that provides security news and advisories about new threats.
The bottom of that article shows additional resources that are
also excellent.
Sun also posts current information about security issues
at site http://sunsolve.sun.com/pub-cgi/secBulletin.pl
Read it frequently to stay on top of the issues. Patches
are identified and made available for downloading at this
site.
SANS Institute http://www.sans.org
is another great
security resource site that carries many articles about
Solaris. One of their more interesting features is at
http://www.sans.org/newlook/resources/hard_solaris.htm
which documents a script for hardening Solaris installations
that was created by a team of professionals led by
Xerox Palo Alto Research Center's Jean Chouanard.
There are far too many to list, but the resources above, coupled with
Sun's BigAdmin site http://www.sun.com/bigadmin
should be more than
enough to get you started.
I strongly suggest setting up the firewall portion of ip_filter.
I have a paper on how to set up ip_filter on your Solaris X86 box.
http://www.riddleware.com/solx86/nat-config.html
Mail me if you need pointers to reliable binaries until I have a current one availabe for download.
For a lightweight Intrusion Detection System try Snort!
Visit http://dev.whitehats.com/index.html for latest exploits to add.
Other resources I've found usefull or informative include:
Other resources I've recieved subsequent to the initial post:
John Weekley says, "You should remove services from /etc/inetd.conf that
have no use in your environment, that will remove a significant portion
of threats you might otherwise encounter.
Some notes from Rich Bejtlich about what a scan of a fresh install of
Solaris 8 1/01 looks like. Solaris 8 1/01 Scan
Bruce Riddle
Last modified: Sun Apr 22 01:09:11 EDT 2001