F    C2 Level Security Configuration

This appendix provides a procedure for configuring your system to meet or exceed a C2 level of security as described in the Orange Book. When the system is used in accordance with a site security policy, a C2 network, and the appropriate physical security, a C2 level environment can be achieved.

You can configure your system to meet the minimum C2 requirements by following the instructions in Section F.3 or you can configure for the maximum practical level of security by using this entire document.

This appendix contains information on the following subjects:

F.1    Evaluation Status

The Tru64 UNIX operating system is delivered with an optional enhanced security subset. When this subset is installed and configured, the system is referred to as a trusted system. The Tru64 UNIX enhanced security features are designed to meet the C2 class of trust, as defined by the Trusted Computer System Evaluation Criteria (also called the Orange Book) An on line version of the Orange Book is available at http://nsi.org/Library/Compsec/orangebo.txt.

The system is also designed to meet the F-C2 functional class, as defined in the Information Technology Security Evaluation Criteria (ITSEC).

The system's security mechanisms maintain full compatibility with existing Tru64 UNIX security mechanisms, while expanding the protection of user and system information.

Contact your sales representative for the latest evaluation and certification status of the Tru64 UNIX product.

F.2    Establishing a Security Policy

A security policy is a statement of the rules and practices that regulate how an organization maintains its computing environment and how the organization manages, protects, and distributes sensitive information.

An organization carries out its security policy by configuring the system as described in this procedure and by adhering to the administrative and procedural guidelines defined in the site policy.

Compaq recommends that you establish a written security policy for your site, as described in the Site Security Handbook (RFC 1244).

Security consulting services are available from Compaq by calling (in the USA) 1.800.AT.COMPAQ. For more information, see the following web site: http://www.compaq.com/services/internet/security/index.html

To create your site's security policy do the following:

After your system is configured, the configuration files should change little and always in predictable ways. During periodic security reviews of your system, compare the base configuration files for content and permissions to the current files. Document the base system and network configuration by obtaining a listing of the following files and attaching them to the security policy: 

/usr/skel/.profile
/usr/skel/.cshrc
/usr/skel/.login
/var/yp/<domain>/auto.master
/var/yp/<domain>/auto.home
/var/yp/<domain>/auto.###
/etc/auto.*
/etc/auth/*
/etc/dumpdates
/etc/ethers
/etc/exports
/etc/fstab
/etc/ftpusers
/etc/group
/etc/hosts
/etc/hosts.equiv
/etc/inetd.conf
/etc/motd
/etc/netgroups
/etc/passwd
/etc/profile
/etc/csh.login
/etc/logout          if used
/etc/remote
/etc/resolv.conf
/etc/rc.config
/etc/rc.site         optional, used with /etc/rc.config
/etc/screend.config
/etc/services
/etc/sec/site_events
/etc/sec/audit_events
/etc/sec/auditd_clients
/etc/sec/event_aliases
/etc/sec/auditd_cons
/etc/sec/audit_loc
/etc/securettys
/etc/svc.conf
/tcb/*
/usr/adm/messages
/var/spool/uucp/Permissions       if UUCP is active
/var/spool/uucp/Systems           if UUCP is active
/var/spool/uucp/remote.unknown    if UUCP is active
/var/adm/cron/at.allow
/var/adm/cron/at.deny
/var/adm/cron/cron.allow
/var/adm/cron/cron.deny
/var/adm/crontab/           any files in these directories
/var/tcb/*
/var/yp/src/*

F.3    Minimum C2 Configuration

Compaq's interpretation of the Orange Book's requirements for a minimum C2 system is that the configuration for Tru64 UNIX is as follows:

F.4    Initial Configuration

After you have installed the Tru64 UNIX software subsets (including the optional enhanced security and documentation extension subsets) onto your system, you will start the software configuration. During the configuration, several of the selections you make will affect the security of your system. The assumption is that you need the maximum practical security configuration for your system. The following sections document the areas of concern for security and Compaq's recommended configuration.

F.4.1    General Configuration

Compaq recommends the following general system configurations:

F.4.2    Enhanced Passwords and Authentication Using secconfig

Select the enhanced password attributes to match your site's security policy. See Section F.2 and Section 7.5.4 for details.

Compaq recommends the following password attributes (defaults are defined in the /etc/auth/system/default file):

Use the Account Manager (dxaccounts) or the edauth program to change the default settings.

F.4.3    Libraries

The libraries on your system can be used in an attack. Secure the libraries as follows:

F.4.4    Account Prototypes and Templates

The account templates used to create user account startup files are /usr/skel/.login, /usr/skel/.cshrc and /usr/skel/.profile.

Account prototypes (referred to as Local Templates) are provided by the Account Manager (dxaccounts). The prototypes let you set attributes like password expiration and login attempts for individual user accounts. If a attribute value is not specified in the local template, the value from the default file is used. The system-wide default attribute values are stored in the /etc/auth/system/default file. System default values are set with the /usr/tcb/bin/edauth command.

Configure user accounts as follows:

F.4.5    Configuring the Audit Subsystem

Before the audit kernel option (Audit Subsystem) can be configured, it needs to be included for the kernel build. Use the audit_setup utility to configure the audit subsystem any time after the kernel build. Compaq recommends that you configure and run audit as follows:

If you are starting the audit daemon from the command line, use the following command: 

# /sbin/init.d/audit start

See Chapter 10 for audit configuration details.

F.4.6    Configuring ACLs

ACL processing can be dynamically enabled using the sysconfig command and can also configured to be enabled automatically as part of system startup using the sysconfigdb command.

See the sysconfig(8) reference page and Chapter 11 for ACL configuration details.

F.4.7    Verifying That Your Installation Is Secure

After you have rebooted the system to enable the enhanced security options, run the fverify and authck programs to verify the integrity of your system.

F.4.8    Configuring Network Security

Proper network configuration is a critical part of your secure computing environment. Use the following checklist as an aid to network configuration:

F.4.9    Postinstallation Security Configuration

After the system is installed and configured, perform the activities in the following sections.

F.4.9.1    umask for Remote Access

Add a umask entry as described in your site security policy to the /etc/csh.login, /etc/profile, and /etc/init.d/inet files. (Note that the /etc/init.d/inet file is overwritten during an update installation.)

F.4.9.2    Devices

Using /usr/tcb/bin/dxdevices, create the devices with the security attributes that reflect your site's security policy.

Ensure that terminal ports are readable only by the owner by modifying the remote login shell file as follows:

Add the following to the /etc/profile file: 

	case "$TERM" in
	none)	;;
	*)	/usr/bin/setacl -b `/usr/bin/tty` ;;
	esac

Add the following to the /etc/csh.login file: 

	if ($?TERM) then
	    if ("$TERM" != "none") then
		/usr/bin/setacl -b `/usr/bin/tty`
	    endif
	endif

See Chapter 8 for details dealing with devices.

F.4.9.3    Accounts

Compaq recommends that you create and verify accounts as follows:

F.4.9.4    Root Access

Because root access must be carefully controlled and monitored, make sure the following conditions are met:

F.4.10    Network Configuration

Review the /etc/svc.conf file and ensure that a logical configuration has been set up for NIS. Also, if NIS is being used, verify that the client machines and the server have the correct domain name defined in the NIS_DOMAIN variable in the /etc/rc.config or /etc/rc.site file.

Ensure that the network files in the following table are protected:

File Comment
/etc/exports Validate the entries. Avoid using the -root= option if possible. Use the -access=<hostname> and -ro options on all specified file systems
/etc/hosts  
/etc/services  
/etc/protocols  
/etc/inetd.conf  
/etc/hosts.equiv Validate that the entries are local hosts.
/etc/ethers  
~username/.rhosts Remove these files or run rlogind and rshd with the -l flag set.

F.5    Physical Security

An important part of your site's security is the physical security of all the components in the environment. Check your physical security as follows:

F.6    Applications

To ensure the security of application software running on your system, make sure that the following conditions are met:

F.7    Periodic Security Administration Procedures

The frequency of the different classes of review activities is determined by your site's security policy. Perform the following activities on a regular schedule:

F.8    Documents

The following documents will help you create and maintain a secure computing environment:

The following documents will help you understand security concepts and procedures:

F.9    Tools

The following tools can help you maintain a secure environment:

The following script is an example of a tool you can create to extract login and logout information from the audit logs: 

#!/usr/bin/ksh -ph
 
# Script to return summary of login/logout activities on the
# system since the last time it was run.
 
export PATH=/usr/sbin:/usr/bin:/usr/ccs/bin:/sbin
 
# where this script should run
Bdir=/var/adm/local
# where to find audit log files
Adir=/var/audit
 
Ofile="${Bdir}/lasttime"
Nfile="${Bdir}/newtime"
Afile="${Bdir}/lastdata"
Tfile="${Bdir}/lastmsg"
 
Events="-e trusted_event"
 
umask 077
 
# ensure the output format we need from date.
export LANG=C LC_ALL=C
export TZ=:UTC
 
if [ ! -f "${Ofile}" ]
then
	print 700101000001 > "${Ofile}"
	touch -t 197001010000.01 "${Ofile}"
fi
 
date +%y%m%d%H%M%S > "${Nfile}"
 
curfile=$(auditd -q)
auditd -dx
sleep 20       # give time for compression of the old log
while [ -f "$curfile" -a -f "$curfile".Z ] || [ -f "$curfile" \
                                   -a -f "$curfile".gz ]
do
    sleep 2	# wait some more
done
 
: > "${Afile}"
 
for af in $(find "$Adir" -name "auditlog.*" -newer "${Ofile}" \
                           -print | sort)
do
	audit_tool -b -t $(<"${Ofile}") -T $(<"${Nfile}") >> \
                    "${Afile}" -o -Q $Events "${af}" 2>/dev/null
 
	# the suppressed errors are for the {un,}compressed messages
done
 
TZ=:localtime
 
if [ -s "${Afile}" ]
then
	audit_tool -B -Q "${Afile}" > "${Tfile}"
	if [ -s "${Tfile}" ]
	then
		Mail -s 'login/out audit summary' root < "${Tfile}"
	fi
fi
 
mv -f "${Nfile}" "${Ofile}"
rm -f "${Afile}"

The following is the crontab entry for the above logging script: 

0 9 * * * /var/adm/local/lreport