HP-UX 11i Version 2 Installation and Update Guide, September 2004

Choosing an Installation Method
Security Considerations
Chapter 3 63
Secured Services and Protocols
Each security configuration bundle provides incrementally higher
security by locking down various protocols and services. HP-UX Bastille
uses a series of questions to determine which services and protocols to
secure. Using one of the Security Configuration bundles applies a default
security profile, simplifying the lockdown process.
The following tables detail the services and protocols affected by the
security bundles, listed in Table 3-4 on page 61, if you choose to apply
one at cold-install- or update-time:
• Table 3-5 on page 64 lists the security settings for Sec10Host. These
settings also apply to Sec20MngDMZ and Sec30DMZ.
• Table 3-6 on page 65 lists the security settings applied with
Sec20MngDMZ, in addition to the settings in Table 3-5.
• Table 3-7 on page 66 lists the security settings applied with
Sec30DMZ, in addition to the settings in Table 3-5 and Table 3-6.
IMPORTANT Review these tables carefully. Some of the locked down services and
protocols may be used by other applications, and may have adverse
effects on the behavior or functionality of these applications. For
example, Servicecontrol Manager and ParMgr rely on WBEM for part of
their functionality; Sec30DMZ blocks all incoming WBEM connections via
IPFilter.
You can change the security settings configured at cold-install- or
update-time by running HP-UX Bastille after installing or updating your
system. For more information about using HP-UX Bastille, refer to
Managing Systems and Workgroups: A Guide for HP-UX System
Administrators, or the HP-UX Bastille User’s Guide located on your
system at: /opt/sec_mgmt/bastille/docs/user_guide.txt