HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

2.8.3.2 Configuring the CDE Lock Manager
You can configure the CDE lock manager to lock your screen after a certain amount of
inactive time. To configure the CDE lock manager to lock the screen after 10 minutes
of inactive time, enter the following commands:
# cp /usr/dt/config/C/sys.resources /etc/dt/config/C/sys.resources
# vi /etc/dt/config/C/sys.resources
dtsession*lockTimeout: 10
You can also use the Style Manager task panel to adjust the CDE lock manager. To do
this, click on the screen icon.
2.9 Protecting Against System Access by Remote Devices
To protect against system penetration by remote access, observe the following
precautions:
• Require the use of a hardware dial-back system for all interactive modems.
• Require an additional password from modem users by adding an entry for the
modem device in /etc/dialups and, optionally, /etc/d_passwd. See
Section 2.9.1.
• Have users renew their dial-in accounts frequently.
• Cancel system access promptly when a user is no longer an employee.
• Establish a regular audit schedule to review remote usage.
• Connect the modems and dial-back equipment to a single HP-UX system, and
allow network services to reach the destination system from that point.
• Make exceptions to dial-back for UUCP access. Additional restrictions are possible
through proper UUCP configuration. See uucp(1) for more information.
Another potential exception is file transfer via kermit. See kermit(1) for more
information.
• If a security breach with unknown factors occurs, shut down both network and
telephone access and inform the network administrator.
• To maximize security when configuring a dial-back modem system, dedicate the
dial-out mechanism to the dial-out function only. Do not configure it to accept
dial-in. Use another modem on another telephone line for your dial-in service.
• Keep telephone numbers for modems unlisted and on a different system from
other business phones. Do not publicize the dial-in phone numbers.
• Physically secure the modems.
• Use caller ID to identify all incoming calls to the modems.
• Do not allow call forwarding or other extra phone services on the modem lines.
Do not use cell phone modems.
• For remote and local access, consider installing an HP-UX AAA server product.
Using the industry-standard Remote Authentication Dial-In User Service (RADIUS)
protocol, the HP-UX AAA Server provides authentication, authorization, and
2.9 Protecting Against System Access by Remote Devices 55