This is an old revision of the document!

1. Configure for more random TCP sequence number generation. Check that in(/etc/default/inetinit), the TCP_STRONG_ISS is set to 2. For instance, TCP_STRONG_ISS=2

2. IP forwarding is to be turned off to prevent the machine acting as a router. To disable IP forwarding, a file “/etc/notrouter” need to be present. If the file is missing, issue the following command to create one : touch /etc/notrouter

To prevent dynamic routes updates via the network, move “in.routed” and “in.rdisc” away from “/usr/sbin” directory by perform the following commands :

 mv /usr/sbin/in.routed /export/home/cfgh/base
 mv /usr/sbin/in.rdisc /export/home/cfgh/base

3. Change default kernel IP settings for better security. Following the following steps to change the kernel IP defaults values :

Setup files and environment:

 touch /etc/init.d/exconfig
 ln -s /etc/init.d/exconfig /etc/rc2.d/S70exconfig
 chmod 744 /etc/init.d/exconfig /etc/rc2.d/S70exconfig

Edit file “/etc/init.d/exconfig” and add the following lines:

 #!/bin/sh
  # /etc/init.d/exconfig
  RELEASE=`/usr/bin/uname -r`
  release7 ()
  {
  /usr/sbin/ex -set /dev/ip ip_forwarding 0
  /usr/sbin/ex -set /dev/ip ip_strict_dst_multihoming 1
  /usr/sbin/ex -set /dev/ip ip_send_redirects 0
  /usr/sbin/ex -set /dev/ip ip_ignore_redirect 1
  /usr/sbin/ex -set /dev/ip ip_forward_src_routed 0
  /usr/sbin/ex -set /dev/ip ip_forward_directed_broadcasts 0
  /usr/sbin/ex -set /dev/ip ip_respond_to_echo_broadcast 0
  /usr/sbin/ex -set /dev/tcp tcp_conn_req_max_q0 4096
  /usr/sbin/ex -set /dev/tcp tcp_ip_abort_cinterval 60000
  /usr/sbin/ex -set /dev/ip ip_respond_to_timestamp 0
  /usr/sbin/ex -set /dev/ip ip_respond_to_timestamp_broadcast 0
  /usr/sbin/ex -set /dev/ip ip_respond_to_address_mask_broadcast 0
  /usr/sbin/ex -set /dev/arp arp_cleanup_interval 60000
  id -a mqm > /dev/null 2>&1
  if [ \$? -eq 0 ]
  then
  /usr/sbin/ex -set /dev/tcp tcp_keepalive_interval 600000
 fi
 }
  release8 ()
 {
  /usr/sbin/ex -set /dev/ip ip6_forwarding 0
  /usr/sbin/ex -set /dev/ip ip6_strict_dst_multihoming 1
  /usr/sbin/ex -set /dev/ip ip6_send_redirects 0
  /usr/sbin/ex -set /dev/ip ip6_ignore_redirect 1
  /usr/sbin/ex -set /dev/ip ip6_forward_src_routed 0
   /usr/sbin/ex -set /dev/ip ip_ire_arp_interval 60000
 }
 release6 ()
 {
 /usr/sbin/ex -set /dev/ip ip_respond_to_echo_broadcast 0

/usr/sbin/ex -set /dev/ip ip_forward_directed_broadcasts 0 /usr/sbin/ex -set /dev/ip ip_strict_dst_multihoming 1 /usr/sbin/ex -set /dev/ip ip_ignore_redirect 1 /usr/sbin/ex -set /dev/ip ip_forward_src_routed 0 }

if [ \$RELEASE = “5.7” ] then

      release7

elif [ \$RELEASE = “5.8” ] || [ \$RELEASE = “5.10” ] || [ \$RELEASE = “5.9” ] then

      release7
      release8

elif [ \$RELEASE = “5.6” ] then

      release6

fi

4. Disable multicast from the server, edit the file “/etc/rc2.d/S72inetsvc” and comment out/remove the following lines : #( #if [ “$_INIT_NET_STRATEGY” = “dhcp” ]; then # mcastif=`/sbin/dhcpinfo Yiaddr` || mcastif=$_INIT_UTS_NODENAME #else # mcastif=$_INIT_UTS_NODENAME #fi # #echo “Setting default Ipv4 interface for multicase:” \ # “add net 224.0/4: gateway $mcastif # #/usr/sbin/route -n add -interface “224.0/4” “$mcastif” >/dev/null #)&

For Solaris 10 Multicast would be disabled using /etc/rc2.d/S72inetsvc-os10

5. Denial of Service Prevention System Settings. Services that must be disabled on all servers, unless required by business function from /etc/services. Services include: ftp-data ftp tftp pop2 pop3 pop-2 nntp chargen daytime discard echo finger talk who whois new-rwho klogin eklogin telnet systat netstat time

6. Prevent “core dump” generated by inetd as it may contain login information. This could be achieved by editing the file ”/etc/rc2.d/S72inetsvc“. Change the line : /usr/sbin/inetd -s & to /usr/bin/ulimit -c 0; /usr/sbin/inetd -s -t & Note : ulimit -c 0 : set the core file size to 0 byte inetd -s -t : stand-alone server with tracing of all tcp connections

For Solaris 10 Create the script /etc/rc2.d/S72inetsvc-os10 as per below. #cat /etc/rc2.d/S72inetsvc-os10 IPADDR=`netstat -nr | grep -w 224.0.0.0 | awk '{print $2}'` /usr/sbin/route -n delete -interface “224.0/4” $IPADDR /usr/sbin/svcadm enable inetd /usr/sbin/inetadm -M tcp_trace=TRUE #chmod 555 /etc/rc2.d/S72inetsvc-os10

7. .netrc files System Settings (.netrc files, .netrc files in root’s home directory). Files are not permitted, remove the files if any, issue command find / -name .netrc -print