Solaris系统安全加固列表(3)

18、使多路广播(multicasting)无效
为了使多路广播(multicasting)无效请在/etc/init.d/inetsvc中注解掉"route add 224.0.0.0"周围的几行。

19、关闭系统的snmp服务
更改 /etc/rc2.d/K07snmpdx 和/etc/rc3.d/S76snmpdx文件名

20、X-Windows不安全，可以使用ssh对其加密

21、加强网络访问控制
编辑/etc/inet.d/inetsvc，在inetd后面加上-t选项
类似命令/usr/sbin/inetd –s –t
停止再运行inetd
运行的使用使用 #/usr/sbin/inetd –s –t

22、网络访问控制
原则：去掉不必要的网络访问，在所需要的网络访问周围简历访问控制

Solaris网络服务（/etc/inet/services）[没有被注释/* */的服务可关闭]
#ident "@(#)services 1.27 00/11/06 SMI" /* SVr4.0 1.8 */
#
#
# Copyright (c) 1999-2000 by Sun Microsystems, Inc.
# All rights reserved.
#
# Network services, Internet style
#
tcpmux 1/tcp /*必须*/
echo 7/tcp
echo 7/udp
discard 9/tcp sink null
discard 9/udp sink null
systat 11/tcp users
daytime 13/tcp
daytime 13/udp
netstat 15/tcp
chargen 19/tcp ttytst source
chargen 19/udp ttytst source
ftp-data 20/tcp /*依服务可选*/
ftp 21/tcp /*依服务可选*/
ssh 22/tcp /*依服务可选*/
telnet 23/tcp /*依服务可选*/
smtp 25/tcp mail /*依服务可选*/
time 37/tcp timserver
time 37/udp timserver
name 42/udp nameserver
whois 43/tcp nicname # usually to sri-nic
domain 53/udp /*依服务可选*/
domain 53/tcp /*依服务可选*/
bootps 67/udp # BOOTP/DHCP server
bootpc 68/udp # BOOTP/DHCP client
hostnames 101/tcp hostname # usually to sri-nic
pop2 109/tcp pop-2 # Post Office Protocol - V2
pop3 110/tcp # Post Office Protocol - Version 3
sunrpc 111/udp rpcbind
sunrpc 111/tcp rpcbind
imap 143/tcp imap2 # Internet Mail Access Protocol v2
ldap 389/tcp # Lightweight Directory Access Protocol
ldap 389/udp # Lightweight Directory Access Protocol
submission 587/tcp # Mail Message Submission
submission 587/udp # see RFC 2476
ldaps 636/tcp # LDAP protocol over TLS/SSL (was sldap)
ldaps 636/udp # LDAP protocol over TLS/SSL (was sldap)
#
# Host specific functions
#
tftp 69/udp
rje 77/tcp
finger 79/tcp
link 87/tcp ttylink
supdup 95/tcp
iso-tsap 102/tcp
x400 103/tcp # ISO Mail
x400-snd 104/tcp
csnet-ns 105/tcp
pop-2 109/tcp # Post Office
uucp-path 117/tcp
nntp 119/tcp usenet # Network News Transfer
ntp 123/tcp # Network Time Protocol
ntp 123/udp # Network Time Protocol
netbios-ns 137/tcp # NETBIOS Name Service
netbios-ns 137/udp # NETBIOS Name Service
netbios-dgm 138/tcp # NETBIOS Datagram Service
netbios-dgm 138/udp # NETBIOS Datagram Service
netbios-ssn 139/tcp # NETBIOS Session Service
netbios-ssn 139/udp # NETBIOS Session Service
NeWS 144/tcp news # Window System
slp 427/tcp slp # Service Location Protocol, V2
slp 427/udp slp # Service Location Protocol, V2
mobile-ip 434/udp mobile-ip # Mobile-IP
cvc_hostd 442/tcp # Network Console
#
# UNIX specific services
#
# these are NOT officially assigned
#
exec 512/tcp
login 513/tcp
shell 514/tcp cmd # no passwords used
printer 515/tcp spooler # line printer spooler
courier 530/tcp rpc # experimental
uucp 540/tcp uucpd # uucp daemon
biff 512/udp comsat
who 513/udp whod
syslog 514/udp /*依服务可选*/
talk 517/udp
route 520/udp router routed
ripng 521/udp
klogin 543/tcp # Kerberos authenticated rlogin
kshell 544/tcp cmd # Kerberos authenticated remote shell
new-rwho 550/udp new-who # experimental
rmonitor 560/udp rmonitord # experimental
monitor 561/udp # experimental
pcserver 600/tcp # ECD Integrated PC board srvr
sun-dr 665/tcp # Remote Dynamic Reconfiguration
kerberos-adm 749/tcp # Kerberos V5 Administration
kerberos-adm 749/udp # Kerberos V5 Administration
kerberos 750/udp kdc # Kerberos key server
kerberos 750/tcp kdc # Kerberos key server
krb5_prop 754/tcp # Kerberos V5 KDC propogation
ufsd 1008/tcp ufsd # UFS-aware server
ufsd 1008/udp ufsd
cvc 1495/tcp # Network Console
ingreslock 1524/tcp
www-ldap-gw 1760/tcp # HTTP to LDAP gateway
www-ldap-gw 1760/udp # HTTP to LDAP gateway
listen 2766/tcp # System V listener port
nfsd 2049/udp nfs # NFS server daemon (clts)
nfsd 2049/tcp nfs # NFS server daemon (cots)
eklogin 2105/tcp # Kerberos encrypted rlogin
lockd 4045/udp # NFS lock daemon/manager
lockd 4045/tcp
dtspc 6112/tcp # CDE subprocess control /*依服务可选*/
fs 7100/tcp # Font server /*依服务可选*/

执行方法：
/etc/inet/services在相应服务前加“#”注释掉
/etc/inet/inetd.conf中注释掉services中相应的条目
查找并重启inetd进程
#ps –ef | grep inetd （获得进程号）
#kill –HUP <进程号>
停止在上述列表中没有定义的服务
方法：将文件改名（用mv命令，可以将S改为X）
停止相应进程
服务：
服务 文件 进程
sendmail /etc/rc2.d/S88sendmail Sendmail
DNS /etc/rc2.d/S72inetsvc中in.named一项注释掉 in.named
named.xfer
NFS /etc/rc3.d/S15nfs.server
注释掉/etc/dfs/dfstab中条目 Nfsd
Automounter /etc/rc2.d/S74autofs
删除/etc/auto_*
ntp /etc/rc2.d/S74xntpd Xntpd
syslog /etc/rc2.d/S74syslog Syslogd
打印 /etc/rc2.d/S80lp lpshut

23、使Sendmail更安全
使用最新版本的Berkeley sendmail (see section 3)，从/etc/aliases里删除decode 将/etc/aliases的权限设为644，关掉expn和vrfy命令。将
O PrivacyOptions=authwarning
改成
O PrivacyOptions=goaway
检查 Sendmail 是否支持发信认证
参考devtools/Site/README文件在devtools/Site下建立如下site.config.m4 文件：
APPENDDEF(`conf_sendmail_ENVDEF', `-DSASL')
APPENDDEF(`conf_sendmail_LIBS', `-lsasl')
给Sendmail编译进SASL支持。
cd sendmail; 执行：sh Build 编译sendmail。
到cf/cf 目录下，拷贝 generic-linux.mc 为 sendmail.mc, 在sendmail.mc 中增加以下内容：
define(`confSMTP_LOGIN_MSG',`$m Server')dnl
改变sendmail欢迎信息
define(`confAUTH_MECHANISMS', `LOGIN')dnl
Unix帐号认证
define(`confPRIVACY_FLAGS',`novrfy,noexpn,noverb')dnl 禁用命令
define(`confMAX_DAEMON_CHILDREN', `128')dnl
define(`confCONNECTION_RATE_THROTTLE', `32')dnl
（抗拒绝服务攻击）