NSA Solaris Security Guides
31 Oct '05 - 00:51 by benrThe United States National Security Agency (NSA - the scary people that can tell what brand of mustard you use from space) has released a variety of OS security guides, all nicely unclassified. Included in the mix are two for Solaris: 8 and 9. A very interesting read indeed. I've been buzzing around the Solaris 9 book tonight and I'm planning to print it and put it in a binder tomorow for further consumption. While we hear about security all the time we don't often get a look at someone elses guidelines and methods making this a very interesting read for any sysadmin. If anyone knows security its the NS-frickin'-A. Download them here. Black Ops helicopters added at no extra charge.
Thanks dude!! This will sure come in handy. We’ve got the spyteck manual to secure Solaris 9 :D
Tomas Gayoso (Email) - 31 October '05 - 01:54
OS setup:– one never sets up /usr/local; NO software is to be added unless packaged, and then following POSIX/SVR4 guidelines: /opt/ for the bulk of the SW, /etc/opt/ for the configuration files, /var/opt/ for the log/and other misc files
– one should never set up separate slices (if filling up the disk is a concern, use quotas and disk monitoring)
– there is no need to use TCP wrappers, because on a secured system, only SSH is running, and all other services are turned off; if access must be controlled, IPFilter should be used to accomplish fine grained access control and logging (to a separate log file)
– patches SHOULD NOT be downloaded to /var/sadm/; that’s what /var/tmp/ is for
IPSec:
– although easy to set up, manual keys should not be used; instead, IKE should be configured at a minimum, and it is recommended to use the X.509 certificates
– there is no need to add to, or modify /etc/init.d/ scripts; instead, a revision control system should be installed on the system as a Solaris package, then the relevant files should be checked into a repository, then finally edited; messing with OS startup scripts can lead to serious problems when upgrading, such as the upgrade overwriting the existing modifications
SSH:
– privilege separation feature should not be used, because it breaks PAM (the NSA complains about it not being available in their paper)
backup of misc. configuration files (such as “inetd.conf”):
– one should never use `mv` to move these files into backup copies (“inetd.conf.orig”), because `mv` will not preserve the original permissions as installed by the Solaris OS; `cp -p ` should be used instead; this, BTW, is one of the most common mistakes that a rookie admin will make
kernel “tuning”:
– /var/crash/ is already automatically designated as the system’s core files repository; if higher security is desired, this directory can be modified with stricter permissions; there is no need to go ‘reinvent the wheel’ and set up a new core dump dir, thereby also compromising system’s integrity
host based firewall:
– sunfreeware.com resp. /usr/local/ should never be used to install software, because a) software from 3rd parties may contain backdoors, and b) sunfreeware.com packages are incorrectly created (they don’t check dependencies)
– if freeware is to be installed, software should be compiled and packaged in-house, or if that is not possible, blastwave.org still make for better packages than sunfreeware.com
– IPFilter version 4 and higher is not to be used, except for the version as shipped with the Solaris10 OS; if IPFilter must be set up in production, version 3.4.35 is the version to use on Solaris, because the non-Sun version 4 still has problems with pfil and IPSec in particular, as evident from the IPFilter mailing list and messages from Darren himself
– if IPFilter version 4 is used, he should be compiled with LKM support, so that the rulesets can be COMPILED by the IPFilter himself into a loadable kernel module; this is done to gain significant performance gains and to foil any attempts to easily modify the ruleset
– rules starting with ”!” (negation) should be avoided at all costs, as they cause terrible perfomance hits; instead, rewrite the ruleset / redesign the logic
– IPFilter should be configured to use his own `syslog` logging facility (for example “local2.info”) and such log(s) should be stored in /var/log/ or to be really conformant, /var/opt/ipfilter/
Conclusion:
A better understanding of Solaris was expected from the NSA. I’m very dissapointed in their obvious lack of understanding of Solaris and the integrity/security implications their measures may have on a system. It is hoped that their own systems are not configured in the manner described in the paper, as the security and OS configuration leaves a lot to be desired.
ux-admin (Email) - 31 October '05 - 03:27
Impossible+only+defines+the+degree+of+difficulty+http%3A%2F%2Fwww%2Etramadol%2Dhcl%2Enet%2F+Success+is+getting+what+you+want%2C+Happiness+is+liking+what+you+get+http%3A%2F%2Fwww%2Ecialis%2Dcheap%2Ecom%2F+In+order+to+succeed%2C+We+must+first+believe+that+we+can+http%3A%2F%2Fwww%2Etramadol%2Dcheap%2Enet%2F+Some+things+have+to+be+believed+to+be+seen+http%3A%2F%2Fwww%2Eviagra%2Donline%2Drx%2Eorg%2F+Blessed+are+the+risk+takers+for+they+shall+bring+us+tomorrow+http%3A%2F%2Fwww%2Ecialis%2Dpromise%2Ecom%2F+Follow+your+heart+and+you%27ll+never+get+lost+http%3A%2F%2Fwww%2Esoma%2Dorder%2Ecom%2F+No+act+of+kindness%2C+however+small%2C+is+ever+wasted+http%3A%2F%2Fwww%2Eviagra%2Dus%2Eorg%2Fbuy+Soma - 29 November '05 - 19:00
Impossible%2Bonly%2Bdefines%2Bthe%2Bdegree%2Bof%2Bdifficulty%2Bhttp%253A%252F%252Fwww%252Etramadol%252Dhcl%252Enet%252F%2BSuccess%2Bis%2Bgetting%2Bwhat%2Byou%2Bwant%252C%2BHappiness%2Bis%2Bliking%2Bwhat%2Byou%2Bget%2Bhttp%253A%252F%252Fwww%252Ecialis%252Dcheap%252Ecom%252F%2BIn%2Border%2Bto%2Bsucceed%252C%2BWe%2Bmust%2Bfirst%2Bbelieve%2Bthat%2Bwe%2Bcan%2Bhttp%253A%252F%252Fwww%252Etramadol%252Dcheap%252Enet%252F%2BSome%2Bthings%2Bhave%2Bto%2Bbe%2Bbelieved%2Bto%2Bbe%2Bseen%2Bhttp%253A%252F%252Fwww%252Eviagra%252Donline%252Drx%252Eorg%252F%2BBlessed%2Bare%2Bthe%2Brisk%2Btakers%2Bfor%2Bthey%2Bshall%2Bbring%2Bus%2Btomorrow%2Bhttp%253A%252F%252Fwww%252Ecialis%252Dpromise%252Ecom%252F%2BFollow%2Byour%2Bheart%2Band%2Byou%2527ll%2Bnever%2Bget%2Blost%2Bhttp%253A%252F%252Fwww%252Esoma%252Dorder%252Ecom%252F%2BNo%2Bact%2Bof%2Bkindness%252C%2Bhowever%2Bsmall%252C%2Bis%2Bever%2Bwasted%2Bhttp%253A%252F%252Fwww%252Eviagra%252Dus%252Eorg%252Fbuy%2BSoma - 29 November '05 - 19:00
Now+get+http%3A%2F%2Fwww%2Ephentermine%2Dovernight%2Ecom%2F+Phentermine+http%3A%2F%2Fwww%2Echeap%2Dadipex%2Enet%2F+Adipex+http%3A%2F%2Fwww%2Ephentermine%2Dpharmacy%2Enet%2F+Phentermine+http%3A%2F%2Fwww%2Eadipex%2Dmed%2Ecom%2F+Adipex+and+http%3A%2F%2Fwww%2Ebuy%2Dhoodia%2Dgordonii%2Enet%2F+hoodia+online%2EPhentermine+side+effects - 01 December '05 - 15:10
I find the great thing in this world is not so much where we stand, as in what direction we are moving: To reach the port of heaven, we must sail sometimes with the wind and sometimes against it, but we must sail, and not drift, nor lie at anchor [[http://www.phentermine-online-order.co..]]Phentermine side effects (Email) (URL) - 02 December '05 - 15:11
It is foolish to postpone enjoyment of your ordinary life until you are more successful, more secure, or more loved than you are today [[http://www.phentermine-online-order.co..]]Phentermine side effects (Email) (URL) - 02 December '05 - 16:02
The+future+belongs+to+those+%22Tramadol%22%3Ahttp%3A%2F%2Fwww%2Etramadol%2Donline%2Eorg%2F+who+believe+in+the+beauty+of+their+dreams%2C+If+your+heart+is+beautiful%2C+you+are+the+most+beautiful+person+on+the+earth+%22Celexa%22%3Ahttp%3A%2F%2Fwww%2Ecelexa%2Ews%2F+that+which+does+not+kill+us+makes+us+stronger+%22Phendimetrazine%22%3Ahttp%3A%2F%2Fwww%2Ephendimetrazine%2Drx%2Ecom%2F+The+only+way+to+succeed+is+to+keep+jumping+off+cliffs+and+build+your+wings+on+the+way+down+%22Prozac%22%3Ahttp%3A%2F%2Fwww%2Eprozac%2Dorder%2Enet%2F+only%2EMonica - 21 January '06 - 23:52
The%2Bfuture%2Bbelongs%2Bto%2Bthose%2B%2522Tramadol%2522%253Ahttp%253A%252F%252Fwww%252Etramadol%252Donline%252Eorg%252F%2Bwho%2Bbelieve%2Bin%2Bthe%2Bbeauty%2Bof%2Btheir%2Bdreams%252C%2BIf%2Byour%2Bheart%2Bis%2Bbeautiful%252C%2Byou%2Bare%2Bthe%2Bmost%2Bbeautiful%2Bperson%2Bon%2Bthe%2Bearth%2B%2522Celexa%2522%253Ahttp%253A%252F%252Fwww%252Ecelexa%252Ews%252F%2Bthat%2Bwhich%2Bdoes%2Bnot%2Bkill%2Bus%2Bmakes%2Bus%2Bstronger%2B%2522Phendimetrazine%2522%253Ahttp%253A%252F%252Fwww%252Ephendimetrazine%252Drx%252Ecom%252F%2BThe%2Bonly%2Bway%2Bto%2Bsucceed%2Bis%2Bto%2Bkeep%2Bjumping%2Boff%2Bcliffs%2Band%2Bbuild%2Byour%2Bwings%2Bon%2Bthe%2Bway%2Bdown%2B%2522Prozac%2522%253Ahttp%253A%252F%252Fwww%252Eprozac%252Dorder%252Enet%252F%2Bonly%252EMonica - 22 January '06 - 00:41
Very interesting and professional site!marvel (URL) - 20 March '06 - 15:10
you have to help me out with mine…meta (Email) (URL) - 22 March '06 - 00:20
You done great work.teena (Email) (URL) - 04 April '06 - 07:30
Can I share some resources with you?lloyd (Email) (URL) - 07 April '06 - 11:54
Can I share some resources with you?lloyd (Email) (URL) - 07 April '06 - 20:03
Very interesting and professional site!mackenzie (Email) (URL) - 08 April '06 - 03:43
Good luck!warren (Email) (URL) - 08 April '06 - 11:11
You done great work.violet (Email) (URL) - 08 April '06 - 19:07
I like this site!mae (Email) (URL) - 09 April '06 - 05:35
I like your website alot…its lots of fun…bobbie (Email) (URL) - 10 April '06 - 13:23
It looks like you really had a nice time.yasmin (Email) (URL) - 10 April '06 - 23:39
Very interesting and professional site!carolee (Email) (URL) - 12 April '06 - 08:00
Hello and congratulations!melony (Email) (URL) - 13 April '06 - 18:50
Hello there! Just want to say that I find your site enough interesting for me. Usefull information and all is good arranged. Thank you for your work. I will visit your site more ofter from now and I bookmarked it.buy phentermine | carisoprodol | phentermine online |
Antony (Email) (URL) - 19 April '06 - 02:43
Very good site. Thanks for author!John (Email) (URL) - 19 April '06 - 02:44
I can’t be bothered with anything these days, but such is life. I don’t care. So it goes. More or less nothing seems worth thinking about. I’ve just been hanging out waiting for something to happen, but that’s how it is.buy phentermine | carisoprodol | phentermine online |
Lemat (Email) (URL) - 19 April '06 - 02:50
So interesting site, thanks!William (Email) (URL) - 19 April '06 - 03:30
CT-Graphics – professional photography, royalty free photos, photo journalism, photo objects, action photography, images – San Diego, California royalty free photos.Stock Photography – Royalty-Free Stock Photos – Photo Objects – Stock Images Low Cost High Resolution at CT-graphics Download royalty free stock photos, stock images, photo-objects at the best stock photography royalty free image site. Search our royalty-free image collections for stock photo objects and royalty free pics for business stock photography, dogs and animals photos, pictures of churches, medical photos, and more! Request pictures at CT – Graphics !!!
CT Graphics (Email) (URL) - 20 April '06 - 06:45
Your site is amaizing. Can I share some resources with you?meta (Email) (URL) - 21 April '06 - 15:11
Great. Thanks!Noris (Email) (URL) - 21 April '06 - 18:35
Your site is very cognitive. I think you will have good future.:)cheap phentermine | buy hydrocodone | ambien | ativan | carisoprodol | carisoprodol | betting | online pharmacy | alprazolam | hydrocodone | cheap phentermine | ambien | soma | phentermine online | phentermine cod | norco | hydrocodone | fioricet | lipitor | alprazolam |
Eugene (Email) (URL) - 22 April '06 - 09:11
Your pictures are great.marvel (Email) (URL) - 23 April '06 - 07:50
Very interesting and professional site! Good luck!meta (Email) (URL) - 23 April '06 - 20:05
It’s my first visit to your website. After just a quick browse, I’m really impressed!“tramadol 50mg” | “valium cheap” | phentermine pill | cheapest phentermine online | phentermine 37.5 mg | order phentermine online | phentermine overnight | diazepam side effects | phentermine cod | phentermine hcl | propecia best | herbal phentermine | Phentermine 37 5mg | what is diazepam | phentermine hydrochloride | “alprazolam pictures” | order tramadol | “order tramadol” | buy phentermine online | phentermine cheap |
Edward (Email) (URL) - 24 April '06 - 05:12
I like this site!ron (URL) - 24 April '06 - 08:02
It looks like you really had a nice time.derek (Email) (URL) - 24 April '06 - 10:54
online casinos,winning online casinos,
online casinos,
casinos online,
online casinos,
online casinos,
online poker rooms (Email) (URL) - 25 April '06 - 01:58
Your site is amaizing. Can I share some resources with you?clifford (Email) (URL) - 25 April '06 - 05:08
This is the coolest La Cocina.Marta (Email) (URL) - 25 April '06 - 12:21
Great. Thanks!teena (Email) (URL) - 26 April '06 - 01:41
This is the coolest La Cocina.caryl (Email) (URL) - 26 April '06 - 07:47
Thanks for the special work and information!becky (Email) (URL) - 26 April '06 - 12:29
Hope you come back soon!!mirian (Email) (URL) - 26 April '06 - 20:41
Very good site. Thanks for author!ephedrine | alprazolam | cheapest didrex online | diazepam generic | valium | alprazolam online | alprazolam addiction | “valium” | diazepam | didrex online | phentermine online | drug diazepam | buy didrex | “alprazolam suicide” | didrex overnight | “order valium” | cheap phentermine online | wellbutrin | xanax | alprazolam mode of action |
Ann (Email) (URL) - 26 April '06 - 20:53
Just whant to say HI! I love this place!Alprazolam Tablets IP 1mg Tranax-1 | “alprazolam suicide” | “natural form of alprazolam” | alprazolam .5 | buy alprazolam | What Does Alprazolam Look like | alprazolam | buy alprazolam online | “Alprazolam Kill You” | alprazolam dosage | “Alprazolam – Gador Alplax 2 mg” | prescription alprazolam cheap without prescription | “alprazolam dosage” | “alprazolam tablets” | color and size of alprazolam | alprazolam and alcohol | 2 mg. alprazolam mylan | alprazolam addiction | alprazolam 0.25 mg drug | “alprazolam partition coefficient” |
Kevin (Email) (URL) - 26 April '06 - 23:24
I am here to say hello and you have a great site!yolonda (Email) (URL) - 27 April '06 - 00:47
Hi you have a nice homepagePeter (Email) (URL) - 27 April '06 - 12:42
Hi you have a nice homepagejay (Email) (URL) - 27 April '06 - 12:46
Hi there! Your site is cool!sonia (Email) (URL) - 27 April '06 - 23:56
Hello and congratulations!Taly (Email) (URL) - 28 April '06 - 12:08
This site is a lot of fun very well designed.orpha (Email) (URL) - 29 April '06 - 00:10
Not much on my mind right now, but it’s not important. I’ve just been letting everything happen without me. I just don’t have anything to say right now.buy vicodin | clomid | phentermine | phentermine | ritalin | canadian pharmacy | betting | buy phentermine | phentermine | online pharmacy | diazepam | diazepam | medication | carisoprodol | betting | didrex | diazepam | diazepam | estradiol | tramadol |
Joe (Email) (URL) - 29 April '06 - 07:19
Just whant to say HI! I love this place!clonazepam | vicodin | lipitor | winstrol | valium | actos | metformin | ambien | carisoprodol | lorazepam | canadian pharmacy | tenuate | vicodin | medication | ritalin | adipex p | estradiol | buy tramadol | xanax | prescription drug |
Kevin (Email) (URL) - 29 April '06 - 07:21
I can’t be bothered with anything these days, but such is life. I don’t care. So it goes. More or less nothing seems worth thinking about. I’ve just been hanging out waiting for something to happen, but that’s how it is.propecia | valium | phentermine free shipping | cheap phentermine | “generic valium” | valium cheap | color and size of alprazolam | metformin | phentermine | “buy valium online” | alprazolam 0.25 mg drug | cheap phentermine online | medication | ritalin | alprazolam | buy valium online | order valium | “buy valium” | how to inject alprazolam tablets | betting |
Kevin (Email) (URL) - 29 April '06 - 13:40
Very interesting and professional site! Good luck!jon (Email) (URL) - 29 April '06 - 23:01
Follow your dreams, you can reach your goals.brandy (Email) (URL) - 30 April '06 - 10:02
It looks like you really had a nice time.tommy (Email) (URL) - 01 May '06 - 09:57
Thanks for the special work and information!caryl (Email) (URL) - 02 May '06 - 08:45
Best site I see. Thanks.betting | hydrocodone 10/500 | hydrocodone sales | Phentermine Cash on Delivery | ambien cr information | cheap phentermine | xanax | Hydrocodone and paypal | viagra | tramadol 50 mg | hydrocodone withdrawl | phentermine vs adipex p | hydrocodone vs oxycodone | cialis | ambien information | prilosec | online pharmacy | didrex | valium | tramadol |
Anny (Email) (URL) - 02 May '06 - 20:35
Hello admin, nice site you have!order hydrocodone online without prior prescription cod | tamiflu | vicodin | Ambien Withdrawal Side Effect | cialis | hydrocodone allergy | mechanism of action of ambien | hydrocodone cod no prescription | phentermine | diet pills | hydrocodone | “valium uk delivery” | lortab | xanax | canadian pharmacy | tramadol 50 mg | betting | vicodin | mexican phentermine and hydrocodone | alprazolam |
Monika (Email) (URL) - 04 May '06 - 01:39
Hello admin, nice site you have!order hydrocodone online without prior prescription cod | tamiflu | vicodin | Ambien Withdrawal Side Effect | cialis | hydrocodone allergy | mechanism of action of ambien | hydrocodone cod no prescription | phentermine | diet pills | hydrocodone | “valium uk delivery” | lortab | xanax | canadian pharmacy | tramadol 50 mg | betting | vicodin | mexican phentermine and hydrocodone | alprazolam |
Monika (Email) (URL) - 04 May '06 - 01:39
Great website! Bookmarked! I am impressed at your work!Louise (Email) (URL) - 04 May '06 - 01:40
Alleen onder Glamour versta ik wat anders maar dat moet kunnen.diet loss phentermine pill weight | viagra | Phentermine Cash on Delivery | ambien class action | ambien truth serum | hydrocodone withdrawal | order phentermine | cheap phentermine without a prescription | phentermine without prescription | phentermine | ambien info | phentermine online | Extra Cheap Phentermine | ambien experience | hydrocodone drug test | phentermine | ambien free | picture of Ambien CR | buy phentermine online | Hydrocodone Drugs |
Halz (Email) (URL) - 05 May '06 - 03:07
It’s my first visit to your website. After just a quick browse, I’m really impressed!Carol Clark (Email) (URL) - 05 May '06 - 03:07
I like your website alot…its lots of fun… you have to help me out with mine…dianne (Email) (URL) - 05 May '06 - 14:10
It’s my first visit to your website. After just a quick browse, I’m really impressed!alternatives to phentermine | order phentermine online | ambien cr side effects | Hydrocodone Online Prescription | picture of Ambien CR | hydrocodone online questionnaire | xanax | “buy tramadol” | cheap phentermine online | phentermine tablet | cialis 20mg | vicodin | buy phentermine online | diarrhea and ambien | tramadol without prescription | buy hydrocodone without prescription | carisoprodol | hydrocodone for sale | buy viagra online | viagra |
Carol Clark (Email) (URL) - 05 May '06 - 17:11
Your site is very cognitive. I think you will have good future.:)Eugene (Email) (URL) - 05 May '06 - 17:11
So interesting site, thanks!ambien addiction | make | make | clonazepam | ambien without a prescription | make | make | make | xanax overnight | hydrocodone drug test | buy hydrocodone without a prescription | online pharmacy hydrocodone | phentermine cheap | Tramadol Hydrochloride | make | make | vicodin | make | discount viagra | make |
barrycmster (Email) (URL) - 06 May '06 - 08:16
Hello Jane, great site!Aktuelle | clomid | Aktuelle | clonazepam | Aktuelle | hydrocodone online | viagra | Aktuelle | xanax overnight | Aktuelle | buy hydrocodone without a prescription | online pharmacy hydrocodone | phentermine cheap | Tramadol Hydrochloride | Aktuelle | hydrocodone no rx | vicodin | Aktuelle | Aktuelle | discount phentermine |
temnotak (Email) (URL) - 06 May '06 - 08:16
Your home page its greatkipetok (Email) (URL) - 06 May '06 - 08:17
HI! I love this place!purchase tramadol | for you | phentermine prescribed online | viagra | ambien canada | for you | for you | cialis generic viagra | cheap phentermine no prescription | Online Phentermine | cialis | clonazepam | Ambien CR studies | no prescription tramadol | ambien info | for you | for you | for you | for you | for you |
lodo4ka (Email) (URL) - 06 May '06 - 11:52
Hello Jane, great site!geroin9l (Email) (URL) - 06 May '06 - 11:52
So interesting site, thanks!ambien cheap | no prescription tramadol | Home Page | online pharmacy | Home Page | Tramadol Withdrawal | viagra | Tramadol Withdrawal | ambien without prescription | tramadol hcl 50mg | Home Page | Home Page | tramadol without prescription | phentermine | Home Page | herbal phentermine | phentermine | tamiflu | phentermine | Home Page |
barrycmster (Email) (URL) - 07 May '06 - 00:50
Your site is very cognitive. I think you will have good future.:)ambien dangers | Health | ambien manufacturer | Health | Health | hydrocodone cod | Health | Health | phentermine diet pills | ambien cr side effects | soma | ambien coupon | no prescription phentermine | Health | xanax | ambien free | buy phentermine without a prescription | ambien dosage | Health | Tripping on Ambien |
nikelir (Email) (URL) - 07 May '06 - 03:28
Hello Jane, great site!geroin9l (Email) (URL) - 07 May '06 - 03:28
Hey man…sorry I missed the party.rena (Email) (URL) - 13 June '06 - 01:07
Your pictures are great.mae (Email) (URL) - 13 June '06 - 16:04
Hey man…sorry I missed the party.cameron (Email) (URL) - 13 June '06 - 16:17
This site is a lot of fun very well designed.