Working with the Unix OS

Unix Security
- HP-UX V7.0 is C2 level
- OSF will soon use Mach kernel = B2 security
Sushi
- first thing a bad person might try once root
# cp /bin/sh /own/bad/sushi
# chmod 4755 /own/bad/sushi
- untraceable access via super-user shell interactive
$ cd /own/bad
$ sushi
#
- never let anyone use root password or login
- no program that is SUID root should be writable
- don't use any SUID shell programs
- checks for SUID programs
- do not use SUID on programs with a shell escape
- use chmod 4755 not chmod +s
- restrict chown to root
find / -user root -perm -4000 -exec ls -l () \; \
| mail root # setuid
find 'echo $PATH | tr ":" " "’ -perm -0002 –exec ls -l ()\; \
| mail root # writable
Crontab
/usr/lib/crontab
/usr/lib/atrun
is started by cron every 10 minutes
User Protection
- Horne directories should not be writable
find 'awk -F: '{print $6}' /etc/passwd' \
-prune -perm -02 -exec ls -ld '{}' \;
- Users .profile, .cshrc, .login, etc
find 'awk -F: '{print "%s/.profile\n", $6}' /etc/passwd' \
-prune -perm -022 -exec ls -1 '{}' \;
- Users .rhosts not readable or writable
find 'awk -F: '(print "%s/.rhosts\n", $6)' /etc/passwd' \
-prune -perm -066 -exec ls -1 '{}' \;
Device Files
- Protect memory and swap files: mem, krnem, swap.
- All devices should be in /dev
# find devices outside /dev
find / -hidden -name /dev -prune -o -type b -exec ls -1 {} \;
# before mounting disks check for SUID files
ncheck -s /dev/dsk/[device name]
# disable SUID files
/etc/mount -o nosuid /dev/dsk/[device name] [mount point]
- Write protect all disk special files to stop corruption
- Read protect disk special files to prevent disclosure
- Individual users should never own a device file other than a terminal device
Network Security
204