Solaris Hardening

Never ever assume that some prepackaged script
 that you are running does anything right.
Admin Horror Stories

Hardening scripts are perfect way to destroy any server, far more effective then hackers ;-). They should be used with the extreme caution. Historically Unix was from the beginning and justifiably, criticized for being a difficult system that is hard to secure. Among typical problems one can list:

• Unix is a very complex OS (although not as complex as NT/Windows2000/Windows XP/Windows 2003 line).
• Unix is a very flexible OS. Unlike NT, Unix is almost nearly infinitely configurable. Unix was designed to be a development environment and it provide a really nice set of tools for developers; most of those essential for developers flexibility features can be abused to defeat the system security.
• Vendors ship insecure systems and default installation usually installs a lot extra redundant packages including some legacy staff that few people use and even fewer understand. For example I cannot explain why Sun decided to install UUCP by default in Solaris 8,9  unless you assume that they targeted it for some remote regions ;-). Unix configuration management tools are still in their infancy.
• Site administrators usually do not have time, resources, and expertise to re-harden the system(s) after system modification of patching. That means that you cannot solve the problem by installing additional security tools.  If something can be misconfigured and misapplied,  it well can be misconfigured and misapplied....
• Timely application of patches by system administrator is still a dream in many situations. Patches sometimes break the applications so system administrators are justifiably vary about putting them without testing on critical system boxes. That means that critical system boxes live without patches longer then uncritical ;-)
• Security is affected by a form of “entropy”  i.e. the “effective security” of a system diminishes with time (natural decay). That means that security needs constant attention. What was secure today will become less secure tomorrow as new security holes will be uncovered in the world.

Although network scanning is more fashionable, internal scanning is much more powerful and reliable. It also more mature and has a rich history. Unfortunately internal scanning and auditing is an often overlooked portion of system administration. Most sites do not utilize the auditing functionality of their systems (for example very few system administrators know about existence of such tools as pwck, grpck, aset on Solaris), etc.

The purpose of internal audit is simple: to identify potential vulnerabilities in systems. It's often a checkout  stage of hardening of the OS. It's much safer practice then automatic hardening using semi-baked scripts. See Solaris hardening page for more details.

Most early tools were distributed under liberal licenses that permit you  modify and  enhance them yourself before use. Titan and COPS are nice examples of  the Unix shell programming culture. I am convinced that  Titan, Cops and Tiger can be used for studying shell programming in universities.

 Solaris[tm] Security Toolkit is Sun supported set of scripts for hardening Solaris. The current version of the Solaris Security Toolkit is 4.2 Supports Solaris 2.5.1-2.10 on both Intel and Solaris. The JASS development team includes Alex Noordergraaf ([email protected]) and Glenn Brunette ([email protected]). Undo was implemented by Dina Kurktchi ([email protected]). It looks like the toolkit is used internally in Sun. Release 4.0.1 provides some enchancements such as:

• Updated undo feature with Backup, Keep, and Force options
• Enhanced support for SunCluster 3x
• Audit functionality has now been replaced by verify mode
• Support for Solaris 9 Intel

but generally scripts are badly written and have a weak architecture (essentially, no architecture at all). JASS does not represent any progress in comparison with Titan and ACET. For more information see my Slightly Skeptical JASS Notes.

The Solaris Security Toolkit 4.2 release is fully supported as part of Solaris Software Support Service Plans or the SunSpectrum(SM) Service Plan contract.

Recommended Links

Softpanorama Recommended

Top articles

Sites

Sun/Solaris Security Toolkit

Solaris Security Toolkit (JASS)

Jass - Jumpstart Installation

Installing and Running Security Software for Sun Solaris Obtaining Support

OpenSolaris Forums: Solaris Security Toolkit (aka JASS) ...

• [Sun] BigAdmin - DocsSecurity
• [Sun] Sun BluePrints OnLine - Security
• ***** GeodSoft How-To Hardening OpenBSD Internet Servers Contents -- althouth this is about OpenBSD, the author really knows what he is talking about...
• **** Technical Whitepapers and Publications by Lance Spitzner. Several papers really worth reading. The importance of honeypots is overblown...
• **** Yassp Post installation steps -- Yassp is dead, but all steps described are still relevant; the paper contains an excellent list of Solaris hardening resources in References and further reading part of the paper.
• **** Unix SysAdm Resources Firewalls & Unix Security -- Stokely Consulting
• **** AusCERT - Australian Computer Emergency Response Team
  • UNIX Security Checklist 
  • UNIX Security Checklist - The Essentials 
     
• ***+ Best Solaris Web Links - searchSolaris.com The Solaris Specific Search Engine -- just links, not very useful
• ***+ CERT® Security Improvement Modules -- this is a government organization; do not expect anything outstanding ;-)

• Each CERT Security Improvement module addresses an important but narrowly defined problem in network security. It provides guidance to help organizations improve the security of their networked computer systems.

  Each module page links to a series of practices and implementations. Practices describe the choices and issues that must be addressed to solve a network security problem. Implementations describe tasks that implement recommendations described in the practices. For more information, read the section about module structure.

  • List of modules
  • List of practices
  • List of implementations
    • General
    • UNIX
      • Configuring Solaris as a WEB server
      • Using Tripwire to verify the integrity of directories and files on systems running Solaris 2.x
      • Inspecting your Solaris system and network logs for evidence of intrusions
      • Inspecting the logs produced by the TCP wrapper program on a Solaris 2.x system
      • Configuring NCSA httpd and Web-server content directories on a Sun Solaris 2.5.1 host
      • Enabling process accounting on systems running Solaris 2.x
      • Installing, configuring, and using tcp wrapper to log unauthorized connection attempts on systems running Solaris 2.x
      • Configuring and using syslogd to collect logging messages on systems running Solaris 2.x
      • Using newsyslog to rotate files containing logging messages on systems running Solaris 2.x
      • Installing, configuring, and using logdaemon to log unauthorized login attempts on systems running Solaris 2.x
      • Installing, configuring, and using logdaemon to log unauthorized connection attempts to rshd and rlogind on systems running Solaris 2.x
      • Understanding system log files on a Solaris 2.x operating system
      • Installing, configuring, and using swatch to analyze log messages on systems running Solaris 2.x
      • Installing, configuring, and using logsurfer on systems running Solaris 2.x
      • Configuring and installing lsof 4.50 on systems running Solaris 2.x
      • Configuring and installing top 3.5 on systems running Solaris 2.x
      • Installing, Configuring, and using npasswd to improve password quality on systems running Solaris 2.x
      • Installing and configuring sps to examine processes on systems running Solaris 2.x
      • Installing and securing Solaris 2.6 servers
      • Installing, configuring, and operating the secure shell (SSH) on systems running Solaris 2.x
      • Characterizing files and directories with native tools on Solaris 2.X
      • Detecting changes in files and directories with native tools on Solaris 2.X
      • Installing and operating lastcomm on systems running Solaris 2.x
      • Installing, configuring, and using spar 1.3 on systems running Solaris 2.x
      • Installing and operating tcpdump 3.5.x on systems running Solaris 2.x
      • Installing, configuring, and using argus to monitor systems running Solaris 2.x
      • Using newarguslog to rotate log files on systems running Solaris 2.x
      • Installing libpcap to support network packet tools on systems sunning Solaris 2.x
      • Writing rules and understanding alerts for Snort, a network intrusion detection system
      • Disabling network services on systems running Solaris 2.x
      • Installing noshell to support the detection of access to disabled accounts on systems running Solaris 2.x.
      • Disabling user accounts on systems running Solaris 2.x
      • Installing OpenSSL to ensure availability of cryptographic libraries on systems running Solaris 2.x.
      • Installing and Operating ssldump 0.9 Beta 1 on systems running Solaris 2.x.
    • NT
    • Other technologies
  • Intended audience
  • Description of module structure
  • Available formats

• ****  TCP tuning under solaris by Jens-S. Vöckler
• ***+ The Solaris Security FAQ Has been updated !!! Better late than never ;-). Still it's far from being up-to-date.
• COAST Archives Computer Operations, Audit, and Security Tools -- outdated, but still might be useful
• Casper's tools (fixmode and others): primitive but useful permissions hardening script used in Titan and other hardening scripts. Some other Solaris tools
• *** Hal Pomeranz's Solaris course done at SANS -- pretty average.

• SolarisGuide.com The Unofficial Guide to the Solaris Operating Environment

• Solaris Security Advisories -- this is a useful page; contains actions for each advisory

• TITAN Home Page -- Titan home

• Pine Security Digest

• LBNL Minumum UNIX Security Configuration  -- list of patches

Government sites:

• The Internet CERT Coordination Center
• CIAC United States Department of Energy's Computer Incident Advisory Capability.