E    C2 Level Security Configuration

This appendix provides information on how to use enhanced security to configure your system to meet or exceed a C2 level of security as described in the Trusted Computer System Evaluation Criteria (also called the Orange Book). An on-line version of the Orange Book is available at http://nsi.org/Library/Compsec/orangebo.txt.

The system is also designed to meet the F-C2 functional class, as defined in the Information Technology Security Evaluation Criteria (ITSEC).

When a system is used in accordance with a site security policy, a C2 network, and the appropriate physical security, a C2 level environment can be achieved; expanding the protection of user and system information while maintaining full compatibility with existing Tru64 UNIX security mechanisms

Contact your sales representative for the latest evaluation and certification status of the Tru64 UNIX product.

This appendix contains the following information:

E.1    Establishing a Security Policy

A security policy is a statement of the rules and practices that regulate how an organization maintains its computing environment and how the organization manages, protects, and distributes sensitive information. A security policy should include:

After your system is configured, the configuration files should change little and always in predictable ways. During periodic security reviews of your system, compare the base configuration files for content and permissions to the current files. Document the base system and network configuration by obtaining a listing of the following files and attaching them to the security policy: 

/usr/skel/.profile
/usr/skel/.cshrc
/usr/skel/.login
/var/yp/<domain>/auto.master
/var/yp/<domain>/auto.home
/var/yp/<domain>/auto.###
/etc/auto.*
/etc/auth/*
/etc/dumpdates
/etc/ethers
/etc/exports
/etc/fstab
/etc/ftpusers
/etc/group
/etc/hosts
/etc/hosts.equiv
/etc/inetd.conf
/etc/motd
/etc/netgroups
/etc/passwd
/etc/profile
/etc/csh.login
/etc/logout          if used
/etc/remote
/etc/resolv.conf
/etc/rc.config
/etc/rc.site         optional, used with /etc/rc.config
/etc/screend.config
/etc/services
/etc/sec/site_events
/etc/sec/audit_events
/etc/sec/auditd_clients
/etc/sec/event_aliases
/etc/sec/auditd_cons
/etc/sec/audit_loc
/etc/securettys
/etc/svc.conf
/tcb/*
/usr/adm/messages
/var/spool/uucp/Permissions       if UUCP is active
/var/spool/uucp/Systems           if UUCP is active
/var/spool/uucp/remote.unknown    if UUCP is active
/var/adm/cron/at.allow
/var/adm/cron/at.deny
/var/adm/cron/cron.allow
/var/adm/cron/cron.deny
/var/adm/crontab/           any files in these directories
/var/tcb/*
/var/yp/src/*

E.2    Minimum C2 Configuration

The Orange Book's requirements for a minimum C2 system is that the configuration for Tru64 UNIX is as follows:

E.3    Initial Configuration

After you have installed the Tru64 UNIX software subsets (including the optional enhanced security and documentation extension subsets) onto your system, you will start the software configuration. During the configuration, several of the selections you make will affect the security of your system. The assumption is that you need the maximum practical security configuration for your system. The following sections document the areas of concern for security and the recommended configuration.

E.3.1    General Configuration

General system configurations include:

E.3.2    Enhanced Passwords and Authentication Using secconfig

Select the enhanced password attributes to match your site's security policy. See Section A.2.2 for details.

Use the following password attributes (defaults are defined in the /etc/auth/system/default file):

Use the Account Manager (dxaccounts) or the edauth program to change the default settings.

E.3.3    Libraries

The libraries on your system can be used in an attack. Secure the libraries as follows:

E.3.4    Account Prototypes and Templates

The account templates used to create user account startup files are /usr/skel/.login, /usr/skel/.cshrc and /usr/skel/.profile.

Account prototypes (referred to as Local Templates) are provided by the Account Manager (dxaccounts). The prototypes let you set attributes like password expiration and login attempts for individual user accounts. If an attribute value is not specified in the local template, the value from the default file is used. The system-wide default attribute values are stored in the /etc/auth/system/default file. System default values are set with the /usr/tcb/bin/edauth command.

Configure user accounts as follows:

E.3.5    Configuring the Audit Subsystem

Before the audit subsystem kernel option can be configured, it needs to be included for the kernel build. Use the sysman auditconfig utility to configure the audit subsystem any time after the kernel build. Configure and run audit as follows:

If you are starting the audit daemon from the command line, use the following command: 

# /sbin/init.d/audit start

See Chapter 3 for more information about the audit subsystem.

E.3.6    Verifying That Your Installation Is Secure

After you have rebooted the system to enable the enhanced security options, run the fverify and authck programs to verify the integrity of your system.

E.3.7    Configuring Network Security

Proper network configuration is a critical part of your secure computing environment. Use the following checklist as an aid to network configuration:

E.3.8    Postinstallation Security Configuration

After the system is installed and configured, perform the activities in the following sections.

E.3.8.1    umask for Remote Access

Add a umask entry as described in your site security policy to the /etc/csh.login, /etc/profile, and /etc/init.d/inet files. (Note that the /etc/init.d/inet file is overwritten during an update installation.)

E.3.8.2    Devices

Using /usr/tcb/bin/dxdevices, create the devices with the security attributes that reflect your site's security policy.

Ensure that terminal ports are readable only by the owner by modifying the remote login shell file as follows:

Add the following to the /etc/profile file: 

	case "$TERM" in
	none)	;;
	*)	/usr/bin/setacl -b `/usr/bin/tty` ;;
	esac

Add the following to the /etc/csh.login file: 

	if ($?TERM) then
	    if ("$TERM" != "none") then
		/usr/bin/setacl -b `/usr/bin/tty`
	    endif
	endif

E.3.8.3    Accounts

Create and verify accounts as follows:

E.3.8.4    Root Access

Because root access must be carefully controlled and monitored, make sure the following conditions are met:

E.3.9    Network Configuration

Review the /etc/svc.conf file and ensure that a logical configuration has been set up for NIS. Also, if NIS is being used, verify that the client machines and the server have the correct domain name defined in the NIS_DOMAIN variable in the /etc/rc.config or /etc/rc.site file.

Ensure that the network files in the following table are protected:

File Comment
/etc/exports Validate the entries. Avoid using the -root= option if possible. Use the -access=<hostname> and -ro options on all specified file systems
/etc/hosts  
/etc/services  
/etc/protocols  
/etc/inetd.conf  
/etc/hosts.equiv Validate that the entries are local hosts.
/etc/ethers  
~username/.rhosts and ~username/.shosts Remove these files or run rlogind and rshd with the -l flag set.

E.4    Physical Security

An important part of your site's security is the physical security of all the components in the environment. Check your physical security as follows:

E.5    Applications

To ensure the security of application software running on your system, make sure that the following conditions are met:

E.6    Periodic Security Administration Procedures

The frequency of the different classes of review activities is determined by your site's security policy. Perform the following activities on a regular schedule:

E.7    Reference Documents and Verification Tools

The following documents will help you create and maintain a secure computing environment:

The following documents will help you understand security concepts and procedures:

The following tools can help you maintain a secure environment:

The following script is an example of a tool you can create to extract login and logout information from the audit logs: 

#!/usr/bin/ksh -ph
 
# Script to return summary of login/logout activities on the
# system since the last time it was run.
 
export PATH=/usr/sbin:/usr/bin:/usr/ccs/bin:/sbin
 
# where this script should run
Bdir=/var/adm/local
# where to find audit log files
Adir=/var/audit
 
Ofile="${Bdir}/lasttime"
Nfile="${Bdir}/newtime"
Afile="${Bdir}/lastdata"
Tfile="${Bdir}/lastmsg"
 
Events="-e trusted_event"
 
umask 077
 
# ensure the output format we need from date.
export LANG=C LC_ALL=C
export TZ=:UTC
 
if [ ! -f "${Ofile}" ]
then
	print 700101000001 > "${Ofile}"
	touch -t 197001010000.01 "${Ofile}"
fi
 
date +%y%m%d%H%M%S > "${Nfile}"
 
curfile=$(auditd -q)
auditd -dx
sleep 20       # give time for compression of the old log
while [ -f "$curfile" -a -f "$curfile".Z ] || [ -f "$curfile" \
                                   -a -f "$curfile".gz ]
do
    sleep 2	# wait some more
done
 
: > "${Afile}"
 
for af in $(find "$Adir" -name "auditlog.*" -newer "${Ofile}" \
                           -print | sort)
do
	audit_tool -b -t $(<"${Ofile}") -T $(<"${Nfile}") >> \
                    "${Afile}" -o -Q $Events "${af}" 2>/dev/null
 
	# the suppressed errors are for the {un,}compressed messages
done
 
TZ=:localtime
 
if [ -s "${Afile}" ]
then
	audit_tool -B -Q "${Afile}" > "${Tfile}"
	if [ -s "${Tfile}" ]
	then
		Mail -s 'login/out audit summary' root < "${Tfile}"
	fi
fi
 
mv -f "${Nfile}" "${Ofile}"
rm -f "${Afile}"

The following is the crontab entry for the above logging script: 

0 9 * * * /var/adm/local/lreport