Introduction

Solaris security broadly falls under two groups - one is where the system is accessible using local area network/vlan and it has to be secured against unauthorized access. Second is system is accessible over the Internet to a number of persons and it has to be protected against unauthorized access using network or security loopholes.

This document details some of the focus areas for security and provides suggestions to make it strong.

Table of Content

1. Latest patches

2. Access to the system.

3. Run level and network services

4. ip module

5. System file , /etc/system

6. sadmind daemon

7. root kit & srload  hack

8. Next Steps

1. Latest patches

Any operating system might have security bugs, which are detected only when system is used in a real time environment. Apply whatever patches are available as of to date to plug the already discovered security loopholes and look for the information about new security related bugs Generally it takes some time when security loophole is discovered and its patch is developed . So the best strategy against such situations is to keep informed by reading security related bulletin of the OS vendor and disabling the affected service or constantly monitoring it and applying patches whenever its available .

A perl script - patchk - is available at sunsolve.sun.com which can be used to identify & compare the existing patches and download the latest ones.

2. Access to the system

Limit Root Access

Limit the direct root access by making sure console entry in /etc/default/login is not commented out . Edit sshd.config and ssh.config to disable root access

If secure shell is being used to access the systems.

Sshd.config

Permit root login no

Permit empty password no

Allow hosts <host list>

Allow users <user list>

Ssh.config

Forward x11 no

Password authentication no

Host based authentication is more secure as it is based on private keys and public keys and only user with the keys are allowed to connect . Password authentication is less secure as they can be guessed or cracked by some programs .

Limit su capabilities

Allow only a few selected members of a group to use su to prevent any unauthorized access by guessing the root password . Create a system administrator’s group and change su owner to root and group to administrator’s group . Change su permissions to allow only member of this group an execute permission .

Remote Access files

.rhosts ,.netrc hosts.equivalent are the files that provides access to the remote systems and should be monitored carefully .They should be checked regularly for any unauthorized entry or if not needed can be made with zero permission - chmod 0 . This will not allow creation of new file by the same name and put entries to gain access.

Keep access log :

sulog file gives information about su login attempts to the system similarly a loginlog file can be created by touching /etc/loginlog which keeps all the login information . Besides last command also give useful information about the persons accessing the system.

3. Run level and network services

Stop unnecessary services at run levels:

/etc/rc2.d and /etc/rc3.d directories have scripts starting at the booting time or when run level is changed . By default a number of services are started out of which only a few might be required . In most of the cases , particularly in production environment certain services are not required at all but provides various ports for gaining entry to the system

Evaluate your system requirements and look at the rc scripts , disable the files that are not required by making letter capital in the beginning as ‘s’ . System requirements may vary from system to system but you should check if you don’t need following services & can disable them.