User's Manual

Actions
Adds a summary description of HP security and services to the TODO.txt
file for user reference.
HP_UX.restrict_swacls
Headline
Restrict remote access to swlist.
Default N
Description
The swagentd daemon allows remote access to list and install software on
your system. This feature is convenient for remote administration. Security
Patch Check can use this to query remote machines. It can also be a security
risk because patch and other critical system information is available to anyone
inside that system's firewall. HP recommends that you disallow the swagentd
default, remote read access.
Actions
If the swagentd daemon is running, use swacl to remove remote read access:
swacl -l host -D any_other
swacl -l root -D any_other
Otherwise, an item is created in the TODO.txt file to remind you to run HP-UX
Bastille again when the daemon is up.
HP_UX.scan_ports
Headline
Provide instructions in your TODO.txt file on how to run a port scan.
Default N
Description One of the final steps in lock down is to verify that only the services you need
are still running. Several tools do this, including netstat which is included
with HP-UX, and lsof (List OpenFiles) which is a free downloadable tool.
The lsof tool provides information about all the processes running on your
system. If there are processes running that you don't recognize, take this
opportunity to do some research and learn about them.
IMPORTANT: Manual action required to complete this configuration. See
the TODO.txt file for details.
Actions
Provide instructions in your TODO.txt file on how to run a port scan.
HP_UX.screensaver_timeout
Headline Set the GUI screen-saver timeout to 10 minutes.
Default N
Description The GUI login screen-saver timeout varies from 10 to 30 minutes depending
on the HP-UX version. This item ensures the value is set at a consistent 10
minutes. Setting a short timeout ensures that extended absences don't leave
a console unnecessarily open.
Actions
For all sys.resources files in /usr/dt/config/* directories, modify the
matching /etc/dt/config/*/sys.resources file by adding the following
lines:
dtsession*saverTimeout: 10
dtsession*lockTimeout: 10
Create the matching /etc/dt/config/*/sys.resources files if not
present.
HP_UX.stack_execute
Headline Enable kernel-based stack-execute protection.
44 Question modules