Version 1.4
1/5/2004

Securing a Solaris Server - Obscure the Tracks

  1. Introduction
  2. History of this Web Page
  3. Overview
  4. Network Topology
  5. System Hardware Configuration
  6. Initial Installation
  7. Minimizing Solaris
  8. Minimizing Network Services
  9. Remove the Solaris Installation Leftovers
  10. Install Necessary Third Party Packages
  11. Close the Doors
  12. Obscure the Tracks
  13. Post the Warnings
  14. Perform System Backups
  15. Watch for Changes
  16. Sources of Tools
  17. Bibliography

---------------

 
Purchase Policies Contact ACCS Aout ACCS Home Papers & Projects Services Products

12. Obscure the Tracks

The goal for this step is to locate the source of messages that a potential intruder can receive, and do whatever can be done, to make them as generic as possible. Remember, any message your computer sends may be used against it.

Some of the messages that would normally be removed here will be removed when we add warning messages. These are in the files /etc/default/ftpd and /etc/default/telnetd.

Apache
After the ServerType line, there should be a line that says ServerTokens Prod. This change will remove the Apache version number and the list of available modules from responses.

Bind (version 8)
In the options section, add the line version "DNS";. This string (DNS) will be given out as the server description.

FTP
This information is covered in the Post the Warnings section.

Sendmail
In the .mc file that is used to generate the sendmail.cf file, set the confSMTP_LOGIN_MSG variable to be $j Sendmail; $b. This change will remove the sendmail version number from responses.

If you are using the default SUN sendmail, then the configuration file (usually /etc/mail/sendmail.cf) should be modified, setting the variable SmtpGreetingMessage to $j Sendmail; $b.

SSH
When using the -v flag of ssh, I know of no way to disable the version number exchange, short of hacking the code.

Telnet
This information is covered in the Post the Warnings section.

Prev Index Next

If you have any comments or suggestions, please E-mail webmaster@accs.com

© 2004 - Ashford Computer Consulting Service