Re: Security for SUN-Cluster 3.0/2.2 with OPS (8.1.7)

From: Trevor Fiatal (trevor@fiatal.net)
Date: 11/05/01 

Message-ID: <3BE5E612.77A0BE70@fiatal.net>
Date: Sun, 04 Nov 2001 17:06:26 -0800
From: Trevor Fiatal <trevor@fiatal.net>
To: Fabrice Bacchella <fabrice.bacchella@synaptique.com>
Subject: Re: Security for SUN-Cluster 3.0/2.2 with OPS (8.1.7)

Fabrice Bacchella wrote:
>
> > * Compile and install the tcpwrappers package. Set up policies in hosts.allow
> > for in.telnetd, in.ftpd, in.rshd, and sshd. Pay especially close attention to the
> > private cluster networks for in.rshd access. Make sure hosts.deny is set
> > up to deny everything else by default.
>
> I always had a bad feeling about tcpwrappers, it can only protect a few
> daemons, those running with inetd and those willing to do so. That's
> little user against a hackers, how will just try something else. Try
> something like ipf instead, you can protect every service running on
> your machine.
>
> And there is no interest in running at the same time telnet, ftp, rsh
> and ssh. Are you sure someone in your organisation will not one day use
> telnet instead of ssh, just because he doesn't have ssh on his computer.
> Just cut all those and dtlogin too. Ssh should be the only remote access
> on your computer if you want it to be useful.

Under most circumstances, I would agree with you.

However, this thread concerns securing SunCluster 2.2 and 3.0
systems. What you've just proposed will break SunCluster and most
likely cause SunService to declare the broken cluster unsupportable
until you reverse the changes. You *really* don't want a SunCluster
system running in production without SunService support.

-Trevor 

-- 
Trevor Fiatal -- trevor@seven.com -- http://www.seven.com/
Co-Founder, CSO
SEVEN
510.967.4556 (work/mobile)  
510.401.8054 (vmail/fax)

Relevant Pages

  • Re: [Full-disclosure] Why Vulnerability Databases cant do everything
    ... best to relegate programming to a ... is a big difference between these two views of information security. ... but not nearly as important as designing secure systems. ... My favorite example to illustrate this point - ssh. ...
    (Bugtraq)
  • RE: Linux hacked
    ... Also, what exactly did the history file show, can you paste it into a mail ... > First let me say I'm a security novice. ... > been unsuccessful in getting root back. ... > via ssh but you could su in once logged in as one of three users. ...
    (Security-Basics)
  • Re: Secure Way of Remotely Viewing a Desktop...
    ... Remote Administrator (aka RAdmin) from Famatech. ... With respect to security, Famatech claims all data ... VNC tunneled through SSH ...
    (Security-Basics)
  • Re: [SLE] need help with X11 security
    ... the security requirements on the SLES 10 box. ... use ssh instead. ... Beta4 no longer works either. ... Check the headers for your unsubscription address ...
    (SuSE)
  • Questions on secure remote access to Fedora Core 2
    ... I am somewhat new to Internet security solutions in general and Linux ... I am setting up a server with Fedora Core 2 (there are specific reasons ... What is the most secure method I can use to give these individuals access ... under ssh. ...
    (comp.os.linux.security)