Default
N
Description
HP-UX Bastille can restrict root from logging into a tty over the network. This
forces administrators to log in first as a non-root user, then
su
to become root.
Root logins are still permitted on the console and through services that do not
use tty's like HP-UX Secure Shell.
Actions
Create or replace the file
/etc/securetty
with the single entry console.
AccountSecurity.crontabs_file
Headline
Ensure the
crontab
files are only accessible by root.
Default
Y
Description
Because a variety of administrators, scripts, and users edit crontab files,
sometimes these files contain incorrect permissions. HP-UX Bastille ensures
these files can only be read and changed by the root user. Perform this task
to ensure these files can only be read and written-to by root, with the
crontab
command.
Actions
Change ownership and permissions for all crontab files permitting access only
to root.
AccountSecurity.cronuser
Headline
Restrict the use of
cron
to administrative accounts.
Default
N
Description
The
cron
function allows you to schedule jobs to run automatically at a certain
time, possibly recurring. Administrators can use
cron
to check the system
logs every night at midnight or confirm file integrity every hour. However,
executing jobs later or automatically represents a privilege that can be abused
and makes actions slightly harder to track.
Actions
Delete the file
cron.deny
Create or replace the file
cron.allow
with a single entry for user
root
Set permissions to
0400
Change ownership to
root:sys
AccountSecurity.gui_login
Headline
Disable the local graphical login.
Default
Y
Description
Most servers do not have a graphics console directly attached, and do not run
a graphics login. Disabling this feature reduces targets for hackers and saves
system resources for systems that do not have a graphics console.
Actions
In the
/etc/rc.config.d/xfs
file, set
RUN_X_FONT_SERVER
=0.
In the
/etc/rc.config.d/audio
file, set
AUDIO_SERVER
=0.
In the
/etc/rc.config.d/slsd
file, set
SLSD_DAEMON
=0.
In the
/etc/rc.config.d/desktop
file, set
DESKTOP
=0.
Terminate the following daemon processes if running: xfs, Aserver, SLSd,
dtlogin, dtrc.
AccountSecurity.hidepasswords
Headline
Hide the encrypted passwords on this system.
Default
N
34
Question modules
