Call : (+91) 968636 4243
Mail : info@EncartaLabs.com
EncartaLabs

HP-UX Security

( Duration: 5 Days )

The HP UX Security training course examines the most common HP-UX system security vulnerabilities, and introduces a variety of tools and techniques that can be used to prevent hackers from exploiting these vulnerabilities.

By attending HP UX Security workshop, delegates will learn to:

  • Use Role Based Access Control (RBAC), Secure Shell (SSH), Host Intrusion Detection System (HIDS), Software Assistant (SWA), IPFilter, Bastille, and other HP supported tools to harden and secure HP-UX systems
  • Create secure, isolated execution environments for applications with HP-UX security compartments and Secure Resource Partitions
  • Use Tripwire, John the Ripper, nmap, lsof, and other open source tools to further improve HP-UX system security

Attend the following course or possess equivalent knowledge:

  • This HP UX Security class is recommended for Experienced system and network administrators responsible for securing and monitoring HP-UX systems

COURSE AGENDA

1

Introduction

2

Securing user accounts: user passwords

  • Understanding the /etc/passwd file
  • Understanding the /etc/shadow file
  • DES-based password encryption
  • SHA512 password encryption
  • Enabling shadow passwords
  • Enabling SHA512 passwords
  • Enabling long passwords
  • Managing passwords
  • Configuring password aging
  • Cracking passwords with John the Ripper
  • Authenticating users via PAM
  • Configuring /etc/pam.conf
3

Securing user accounts: special cases

  • Protecting user accounts: guidelines
  • Protecting the root account: guidelines
  • Limiting root and operator access via /etc/security
  • Limiting root and operator access via sudo
  • Limiting root and operator access via the restricted SAM builder
  • Limiting root and operator access via the SMH
  • Configuring accounts for guest users
  • Configuring accounts for single application users
  • Configuring accounts for teams and groups
  • Preventing dormant accounts
4

Securing user accounts: Standard Mode Security Extensions (SMSE)

  • Configuring SMSE user security
  • Understanding Standard Mode Security Enhancements Benefits
  • Understanding SMSE attributes and repositories
  • Configuring /etc/security.dsc
  • Configuring /etc/default/security
  • Configuring /etc/passwd and /etc/shadow
  • Configuring /var/adm/userdb/ via userdbset, userdbget, and userdbck
  • Enforcing SMSE security policies
5

Securing user accounts: Role Based Access Control (RBAC)

  • RBAC features and benefits
  • Installing RBAC
  • Configuring & assigning RBAC roles
  • Configuring & assigning RBAC authorizations
  • Configuring RBAC commands & privileges
  • Verifying the RBAC database
  • Configuring RBAC logging & auditing
  • Running commands with privrun
  • Editing files with privedit
  • Enabling RBAC keystroke logging
6

Protecting data via file permissions and JFS Access Control Lists (ACLs)

  • Understanding how hackers exploit improper file and directory permissions
  • Viewing and changing file permissions
  • Searching for files with improper permissions
  • Configuring and using the SUID bit
  • Configuring and using the SGID bit
  • Configuring and using the sticky bit
  • Configuring and using JFS ACLs
7

Protecting data via swverify, md5sum, and Tripwire

  • File integrity checking overview
  • Verifying executable integrity with swverify
  • Verifying file integrity with md5sum
  • Verifying file integrity with Tripwire
  • Installing Tripwire
  • Creating Tripwire keys
  • Creating the Tripwire configuration file
  • Creating the Tripwire policy file
  • Creating the Tripwire database
  • Performing a Tripwire integrity check
  • Updating the Tripwire database
  • Updating the Tripwire policy file
8

Protecting data via Encrypted Volumes and File Systems (EVFS)

  • EVFS, EVS, and EFS features and benefits
  • EVFS architecture
  • EVFS volumes
  • EVFS volume encryption keys, user keys, and recovery keys
    • Step 1: Installing and configuring EVS software
    • Step 2: Creating user keys
    • Step 3: Creating recovery keys
    • Step 4: Creating an LVM or VxVM volume
    • Step 5: Creating EVS device files
    • Step 6: Creating and populating the volume’s EMD
    • Step 7: Enabling the EVS volume
    • Step 8: Creating and mounting a file system
    • Step 9: Enabling autostart
    • Step 10: Migrating data to the EVS volume
    • Step 11: Backing up the EVS configuration
  • Managing EVS volume users
  • Managing the EVS key database
  • Extending an EVS volume
  • Reducing an EVS volume
  • Removing EVS volumes
  • Backing up EVS volumes
  • EVS limitations
  • EVS and TPM/TCS integration overview
9

Securing network services: inetd & tcpwrapper

  • inetd service overview
  • inetd configuration file overview
  • Securing inetd
  • Securing the inetd internal services
  • Securing the RPC services
  • Securing the Berkeley services
  • Securing FTP
  • Securing FTP service classes
  • Securing anonymous FTP
  • Securing guest FTP
  • Securing other ftpaccess security features
  • Securing other inetd services
  • Securing other non-inetd services
  • Securing inetd via TCPwrapper
10

Securing network services: SSH

  • Legacy Network Service Vulnerabilities: DNS
  • Legacy Network Service Vulnerabilities: Sniffers
  • Legacy Network Service Vulnerabilities: IP spoofing
  • Solution: Securing the Network Infrastructure
  • Solution: Using Symmetric Key Encryption
  • Solution: Using Public Key Encryption
  • Solution: Using Public Key Authentication
  • HP-UX Encryption & Authentication Product overview
  • Configuring SSH encryption & server authentication
  • Configuring SSH client/user authentication
  • Configuring SSH single sign-on
  • Managing SSH keys
  • Using the UNIX SSH Clients
  • Using PuTTY SSH Clients
11

Securing network services: IPFilter & nmap

  • Firewall overview
  • Packet filtering firewalls
  • Network Address Translation firewalls
  • Host versus perimeter firewalls
  • Installing IPFilter
  • Managing IPFilter rulesets
  • Configuring a default deny policy
  • Preventing IP and loopback spoofing
  • Controlling ICMP service access
  • Controlling access to UDP services
  • Controlling access to TCP services
  • Controlling access via active and passive FTP
  • Testing IPFilter rulesets with ipftest
  • Testing IPFilter rulesets with nmap
  • Monitoring IPFilter & Nessus
12

Hardening HP-UX with Bastille

  • Bastille overview
  • Installing Bastille
  • Generating a Bastille assessment
  • Creating a Bastille configuration file
  • Applying a Bastille configuration file
  • Applying a pre-configured Bastille configuration file
  • Applying a pre-configured Bastille configuration via Ignite-UX
  • Reviewing the Bastille logs
  • Monitoring changes with bastille drift
  • Reverting to the pre-Bastille configuration
  • Integrating Bastille and HP SIM
13

Monitoring activity via system log files

  • Monitoring log files
  • Monitoring logins via last, lastb, and who
  • Monitoring processes via ps, top, and whodo
  • Monitoring file access via ll, fuser, and lsof
  • Monitoring network connections via netstat, idlookup, and lsof
  • Monitoring inetd connections
  • Monitoring system activity via syslogd
  • Configuring /etc/syslog.conf
  • Hiding connections, processes, and arguments
  • Doctoring log files and time stamps
14

Monitoring activity via SMSE auditing

  • Auditing overview
  • Trusted system versus SMSE auditing
  • Enabling and disabling auditing
  • Verifying auditing
  • & system calls to audit
  • Selecting users to audit
  • Selecting system calls, aliases, and events to audit
  • Creating and applying an audit profile
  • Viewing and filtering audit trails via auditdp
  • Switching audit trails
  • Understanding audomon AFS & FSS switches
  • Understanding audomon audit trail names
  • Configuring audomon parameters
  • Configuring audomon custom scripts
15

Monitoring suspicious activity via HP’s Host Intrusion Detection System (HIDS)

  • HIDS overview
  • HIDS architecture
  • Installing HP’s HIDS product
  • Configuring HIDS detection templates and properties
  • Configuring HIDS surveillance groups
  • Configuring HIDS surveillance schedules
  • Configuring HIDS response scripts
  • Assigning surveillance schedules to clients
  • Monitoring HIDS alerts and errors
16

Managing security patches with Software Assistant (SWA)

  • Security patch overview
  • SWA overview
  • Reading US-CERT advisory bulletins
  • Reading HP-UX security bulletins
  • Installing swa
  • Generating swa reports
  • Viewing swa reports
  • Retrieving swa recommended patches
  • Installing swa patches
  • Installing other products recommended by swa
  • Applying other manual changes
  • Regenerating swa reports
  • Purging swa caches
  • Viewing swa logs
  • Customizing swa defaults
  • Integrating SWA and HP SIM
  • Preventing unauthorized swa and swlist access
  • Preventing buffer overflow attacks
  • Setting the executable_stack kernel parameter
  • Setting the chatr +es executable stack option
17

Hardening HP-UX with Bastille

  • Bastille overview
  • Installing Bastille
  • Generating a Bastille assessment
  • Creating a Bastille configuration file
  • Applying a Bastille configuration file
  • Applying a pre-configured Bastille configuration file
  • Applying a pre-configured Bastille configuration via Ignite-UX
  • Reviewing the Bastille logs
  • Monitoring changes with bastille_drift
  • Reverting to the pre-Bastille configuration
18

Isolating applications via security compartments

  • Security compartment concepts
  • & Using FGP TRIALMODE
  • Compartment rule concepts
  • INIT compartment concepts
  • Installing compartment software
  • Enabling compartment functionality
  • Creating and modifying compartments
  • Viewing compartments
  • Adding network interface rules
  • Adding file permission rules
  • Adding a compartment-specific directory
  • Viewing compartments
  • Configuring compartment administrators
  • Configuring compartment users
  • Executing commands in compartments
  • Removing compartments
  • Disabling compartment functionality
19

Isolating Applications via Secure Resource Partitions

  • SRP concepts
  • SRP example
  • SRP subsystems
  • SRP templates
  • SRP services
  • Installing SRP
  • Enabling and configuring SRP
  • Verifying the SRP configuration
  • Creating an SRP interactively
  • Creating an SRP non-interactively
  • Adding the init, prm, network, ipfilter, login, and ipsec services to an SRP
  • Adding the ssh, apache, tomcat, and oracle templates to an SRP
  • Adding the custom template to an SRP
  • Deploying an application in an SRP
  • Updating an SRP
  • Viewing the SRP configuration & status
  • Starting & stopping an SRP
  • Accessing an SRP
  • Removing an SRP

Encarta Labs Advantage

  • One Stop Corporate Training Solution Providers for over 6,000 various courses on a variety of subjects
  • All courses are delivered by Industry Veterans
  • Get jumpstarted from newbie to production ready in a matter of few days
  • Trained more than 50,000 Corporate executives across the Globe
  • All our trainings are conducted in workshop mode with more focus on hands-on sessions

View our other course offerings by visiting https://www.encartalabs.com/course-catalogue-all.php

Contact us for delivering this course as a public/open-house workshop/online training for a group of 10+ candidates.

Top
Notice
X