Well, I'll delve a bit more, adding to Bruce Ray's excellent comments, as the
following may be useful to any using SunOS 4.1.3_U1 (and especially since
Bruce's email came to me just before I was going to send this (: ). I'll have to
study Bruce's comments (Bruce: what's the -:::::: do in passwd?);
he's clearly more up on this than me!! Karen Ann's
comments are bothering a few SGI users here that thought they were ok, and
had me convinced they were also (I have only Sun's under my control).
1. Make sure you feel reasonably comfortable with the following files
on your suns in the /etc file:
passwd
hosts
exports
group
fstab
hosts.equiv
ttytab
2. Watch out for vnmr's makeuser: it does not install passwd for new users
(i.e. allows username only logins until changed). Insert a * between the colons
following the username until someone is actually using the account:
saveid:*:1111:30:Save id for later use:/home/saveid:/bin/csh
3. Remove any + symbols from hosts.equiv (especially dangerous), group and any
other files you happen to find one in.
4. Disable non-console root logins by removing secure from all but the first
(console) line in ttytab.
5. Limit su priviledges with group by adding only managers names in wheel line:
wheel:*:0:root,cathy
6. Allow exporting (cross mounting) only to machines you know about, and
use complete node names when specifying (in exports):
/usr/openwin -ro,access=name.at.node.address
7. Make sure .rhosts are nonexistant, or very carefully controlled.
8. Control passwords: I make users give me their passwords and changes,
and I check them about once a month, and request they change them about
every six to eight weeks. I do keep a list of the passwords on paper, but
don't worry as much about this security breach as a possible short, poor
password a nontypist user might change to that would allow an external
hacker to get in. I force users to use a
combination of small and caps and numbers in an eight character
password.
I just looked over my patch documentation, and the following are recommended
by Sun for 4.1.3_U1:
Solaris 1.1.1 Patches Containing Security Fixes:
------------------------------------------------
101434-03 SunOS 4.1.3_U1: lpr Jumbo Patch
101440-01 SunOS 4.1.3_U1: security problem: methods to exploit login/su
101558-03 SunOS 4.1.3_U1: international libc jumbo patch
101579-01 SunOS 4.1.3_U1: Security problem with expreserve for Solaris 1.1.1
101587-01 SunOS 4.1.3_U1: security patch for mfree and icmp redirect
101621-02 SunOS 4.1.3_U1: Jumbo tty patch
101665-03 SunOS 4.1.3_U1: sendmail jumbo patch
101679-01 SunOS 4.1.3_U1: Breach of security using modload
101759-02 SunOS 4.1.3_U1: domestic libc jumbo patch
102060-01 SunOS 4.1.3_U1: Root access possible via forced passwd race condition
100448-02 OpenWindows 3.0: loadmodule is a security hole.
100452-68 OpenWindows 3.0: XView 3.0 Jumbo Patch
100478-01 OpenWindows 3.0: xlock crashes leaving system open
Yah, I installed all these plus 13 more.
We didn't change to Solaris 2.x because of comfort with Berkeley shell, but
these patches might get one over the hump to System V (although I wonder
if it's any better?).
Anyway, hope this helps (from one still learning--and not liking--UNIX
security problems).
Charlie Fry
fry@chem.wisc.edu