22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

396 Lotus Security Handbook<br />

The following three papers are excellent starting points for building secure<br />

Solaris servers:<br />

► “Solaris Operating Environment Minimization for Security: A Simple,<br />

Reproducible and Secure Application Installation Methodology” by Alex<br />

Noordergraaf and Keith Watson. Although this paper specifically <strong>cover</strong>s the<br />

iPlanet Web server requirements, similar requirements are necessary for<br />

using Apache, Domino, or other Web servers.<br />

► “Solaris Operating Environment Security” by Alex Noordergraaf and Keith<br />

Watson. This is an overview of general security options on a Solaris server.<br />

This paper includes some specifics for the SPARC architecture; however,<br />

most of the material is applicable to Intel® architectures as well.<br />

► "Solaris Operating Environment Network Settings for Security" by Alex<br />

Noordergraaf and Keith Watson is another excellent paper on kernel tuning<br />

and application parameters that affect network security.<br />

As a matter of fact, Sun's Blueprints Online is a wealth of whitepapers outlining<br />

best practices regarding Solaris Operating Environments, whether it is a Web<br />

server in the DMZ, a firewall, or an internal highly available Domino cluster.<br />

Lance Spitzner also has an excellent Solaris hardening document that details the<br />

hardening process for building a Check Point FireWall-1 firewall on several<br />

recent versions of Solaris (through version 8) for the Intel and SPARC platforms.<br />

The living document resides at the following URL:<br />

http://www.enteract.com/~lspitz/armoring.html<br />

Finally, there is an equivalent to the Bastille-Linux hardening scripts for Solaris<br />

called TITAN. The TITAN project and documentation can be found at the<br />

following URL:<br />

http://www.fish.com/titan/<br />

9.4.8 Tweaking the network configurations for security<br />

To protect the organization’s WAN connections, firewall, and DMZ servers from<br />

common attacks, the following simple steps should be followed to disable certain<br />

TCP/IP features.<br />

Dropping source-routed traffic<br />

There are actually two forms of source-routed traffic: Strict Source-Routed and<br />

Loose Source-Routed. The differences aren't that important because it’s best to<br />

to drop all source-routed traffic.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!