HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

— Check all directories for privileged programs, and verify the identity of every
program.
— Remount the system read and write permissions and remove any unnecessary
setuid and setgid permissions from files that you discovered in the previous
step. These precautions are especially important if a user requests that you
mount a personal file system.
Only after performing these tests should you unmount the file system and remount
it in its desired location.
• Be sure to unmount all mounted file systems of a user whose account you are
disabling or removing.
For information on files mounted in an NFS environment, see Section 5.10.2.
5.10 Controlling File Security on a Network
From the perspective of security, networked systems are more vulnerable than
standalone systems. Networking increases system accessibility, but also adds greater
risk of security violations.
Although you cannot completely control security over the network, you can control
the security of each node on the network to limit penetration risk without reducing the
usefulness of the system or user productivity.
Ensure that all network administration programs are owned by a protected,
network-specific account, such as uucp, nso, or daemon, rather than by root.
5.10.1 Check Permission Settings on Network Control Files
Modes, owners, and groups on all system files are set carefully. Check these files
regularly for any changes. Note and correct any changes from the original values.
Pay particular attention to the network control files in the /etc directory. These files
are of notable interest to those attempting to gain unauthorized access, because they
provide access to the network itself. Network control files should never be writable by
the public. These files include:
exports
List of file systems being exported to NFS clients
hosts
Network hosts and their addresses
hosts.equiv
Remote hosts allowed access equivalent to the local host
inetd.conf
Internet configuration file
netgroup
List of networkwide groups
networks
Network names and their addresses
protocols
Protocol name database
services
Services name database
106 File System Security