From: Subject: Securing SNMP on Solaris Date: Wed, 14 Nov 2001 08:35:53 +0100 MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_NextPart_000_0009_01C16CE7.5F656410"; type="multipart/alternative" X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 This is a multi-part message in MIME format. ------=_NextPart_000_0009_01C16CE7.5F656410 Content-Type: image/gif Content-Transfer-Encoding: base64 Content-Location: http://ist.uwaterloo.ca/ISTlogo.gif R0lGODlhYABfALMAAP///wAAAJ2dnYAGHPDm6F1dXSwsLNK3vKJJWkZGRv7+/saQmrNreIKCgpIq PeHM0CH5BAEAAAAALAAAAABgAF8AAAT+EMhJq7046827/2AojmRpnmiqrmzrvuZxbAoB3yAzT8ww MJPHAOHY4Y4SI2AxUCQHB6ZzCR0ikUKGDXCASoSL3rQHcAAzhMP2SmIOtorfhFnkaQcLjcMhZ48I CE0TCGcbBGsXe10Pfh0EOhMEPkonj10OD4iNFwd7A4wSCwdTKZKieJsbCAt7DqQuXT6gCpSpAAoO C4SaLWmgAEK/jWu4XpsMDo+8OIF5Eq9sTg5EdVcKrM22EmY+DNDMA8nI32wPZsJHgEXhBOTat3vL KQqBMgju2g9drDfF6O8UOmHDh4LAAoLvEARyoaAQQA7XaqFghfDhhUcM/oWQhMrih2v+PpyZIMDH oUcNgfZU9HBA40kLZm693KQPxQMG3jIcaMCTp4cHDwQIHSpgCwGiSJMOlXgCFx8EGQQEmBrAgKEC BqhqnbpD6tavXwtguKlFhBBaDqJuzaCgAditOw68nRtArIU4Q6BuDBcTg9epVi8oSECXatfCYO1W MCVFxIFV+P5WxVAAMdcklrcqrpAr3EoRAgyINpDgguTCcUUnUJ1V62rSohtgeLTA5QVR8kQQaE21 AFMNbqkGhkHkUwq5WmWPCA4YRycfuU4wn/rZwvThH/SJ3BDl8W8JAlav3iyhcu8S10HgDQdLK/by WsmDSA9ClLncJCS/B2B+qvwP9H3+cAAyxqygn3Xu4QeceyHQYdwGQoTEwYEVnNZAdRQECMIDCnHQ BU7fgcfgYl8ZUFQIGjriQx8aCKTGhCNW0N9WBhRwIgcpdoBbBz1MAqNwF/E2l4345OgCUAoCQKEF u2XWwDJGarMkk9PRZQAvUWpwyAtTXhQeYldWkGUG65g0G5IexmjITqu9pdwEXXJAEgNEbMDHitv5 peYHRwlJXYZ7yllSWijhtEBtPzZHwmBbCQAokCHgVBMLcYJAgGaPKupRpSDMWNoEY27CKYBqhtrI qB5MaaofqHag4ao2VdQqB55mOlkID2D4WJ6cbJUkW1u9CQCsc5hR3T4IKRBsCTP+BqDErIv15cEh tlFAWHzV3nWAnwG8QuwzW76A3FfKKcAabOi6KWagDzXr3zOZJbgupC8xiikAl8Z72byaspGkAs3a pWy8Bmi06iMotERIBwdcW5cE+SKWgADurLqPCXixku0EtAiwgwJKIZUrhEjJqU+BIxSxh5kzwbTi gyMUg0nLNGgn7QgMHEQzWxTgEmJ29+xMwS5BqBCLzjs35AMCvwoYThZCd/EIOytcQ09HNEuyBxMb R4r1zo/lnEwvOxiURyYPDbgGMk2TEMgPN6eCDB9tV4JHLHWrAAcUwfg7Dd1yuyJBOGz7MXUt7Rxx Mb5EN0LLBcgskLfXk18x9Q94lWNACyhaC91D4aV44sxjmePQOQtMAFCn0KEUiI1tq0MchRVUsMLy TBR98UNjSzROhC42aN2DDdeYUbotHwZiw4c4SfB5R9OYwnoH9CjifBNrDwBAH2KsMv20I+M7RB9S 9PUA0t//IUMkB6Gd/vvwxy///PTXz0EEADs= ------=_NextPart_000_0009_01C16CE7.5F656410 Content-Type: multipart/alternative; boundary="----=_NextPart_001_000C_01C16CE7.5F656410" ------=_NextPart_001_000C_01C16CE7.5F656410 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Content-Location: http://ist.uwaterloo.ca/security/howto/2000-10-04/ Securing SNMP on Solaris = =0A= <body>=0A= Oops! Your browser doesn't support frames. Try starting at the=0A= <A HREF=3D"content.html">Table of Contents</A>.=0A= </body>=0A= ------=_NextPart_001_000C_01C16CE7.5F656410 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Content-Location: http://ist.uwaterloo.ca/security/howto/2000-10-04/content.html Contents: Solaris Network Hardening
3D[IST]=20=20


Synopsis

The Problem
What We Learned
Recommendation
Postscript

References

------=_NextPart_001_000C_01C16CE7.5F656410-- ------=_NextPart_000_0009_01C16CE7.5F656410 Content-Type: image/gif Content-Transfer-Encoding: base64 Content-Location: http://ist.uwaterloo.ca/icons/hand.right.gif R0lGODlhFAAWAMIAAP/////Mmcz//5lmMwAAAAAAAAAAAAAAACH+TlRoaXMgYXJ0IGlzIGluIHRo ZSBwdWJsaWMgZG9tYWluLiBLZXZpbiBIdWdoZXMsIGtldmluaEBlaXQuY29tLCBTZXB0ZW1iZXIg MTk5NQAh+QQBAAACACwAAAAAFAAWAAADTCi63P4wykkdubiSwDuRVydi5CWEYjBsKbe2rDjMdMwR w1iaaZx7jcDm8nOpVsFjsSh0CFuq46fxko0eKOtsiu0UuRHfVlOqmM9oSgIAOw== ------=_NextPart_000_0009_01C16CE7.5F656410 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Content-Location: http://ist.uwaterloo.ca/security/howto/2000-10-04/recommend.html Securing SNMP on Solaris

Security Review: Securing SNMP on Solaris =
Information=20 Systems and Technology
University of Waterloo

Recommendation

To configure public SNMP services on a = Solaris 8=20 server and restrict the service to a short list of managers we = recommend:=20
  1. First, make sure you have configured syslogd(1M) to be = far more=20 verbose about logging what's happening. We recommend a very verbose = audit=20 (at least during the install):=20 

    [2:39 wally] grep /syslog /etc/syslog.conf
#mail.debug          ifdef(`LOGHOST', /var/log/syslog, @loghost)
*.debug              ifdef(`LOGHOST', /var/log/syslog, @loghost)

    The default configuration is to log everything wrt. mail services = at the=20 debug level to the file /var/log/syslog. We recommend you log = everything to the same file. When things go wrong, as they sometimes = do, a=20 good audit trail will be important.=20

  2. Stop the vendor provided SNMP and = DMI=20 services on your system:=20 

    [2:40pm wally]# cd /etc/init.d
[2:40pm wally]# ./init.dmi stop
[2:40pm wally]# ./init.snmpdx stop

    If you want to restart those services run the shell scripts with = a=20 "start" option instead. You may find these scripts = with=20 different names on other versions of Solaris (but I suspect not).=20

  3. Configure the boot sequence so the vendor provided = SNMP=20 and DMI services aren't restarted at next reboot:=20 

    [2:41pm wally]# cd /etc/rc3.d
[2:41pm wally]# mv S76snmpdx No.S76snmpdx
[2:41pm wally]# mv S77dmi No.S77dmi

    Renaming the startup scripts effectively removes them from the = boot=20 sequence. You may find these scripts with different = names on=20 other versions of Solaris (but I suspect not).=20

  4. Configure the "managers" that can send SNMP = requests to=20 the mibiisa(1) server -- edit the snmpd.conf file. = Here's what=20 we use (note that we've filled in the "system" information, = restricted the=20 service to only "public" information, tossed anything to do with = "traps" and=20 restricted the managers to just ratbert):=20 

    [2:43pm wally]# cd /etc/snmp/conf
[2:43pm wally]# egrep -v '^$|^#' snmpd.conf 
sysdescr        Sun SNMP Agent, SPARCstation-10
syscontact      dilbert@ist.uwaterloo.ca
sysLocation     IST Machine Room, Rack 4, Tray 3
system-group-read-community     public=20
read-community  public=20
managers        ratbert

    The "grep" in the example tosses all commentary and empty lines = --=20 there's not much to the file. Note the configuration shown only = allows=20 ratbert to query wally. It's a very simple = configuration --=20 we've even tossed the traps that we didn't need. We've updated the = "system"=20 information so we can find the system (it's physical location) and = the=20 support person.=20

  5. Configure your boot sequence to bring up only the = mibiisa(1M)=20 daemon and none of the others. Make sure you bring it up in = read-only mode.=20 Here's a sample configuration you might wish to use:=20 

    #!/sbin/sh
#
# $Id: recommend.html,v 1.2 2001/03/19 15:15:51 reggers Exp $
#
# Start the minimal SNMP services required for select managers to get =
public
# data. Install as /etc/rc3.d/S99mibiisa (or insert into your favorite =
local
# boottime script). Make sure you disable S76snmpdx and S77dmi in the =
same
# directory.
#
# Reg Quinton <reggers@ist.uwaterloo.ca>; 5-Oct-2000

case "$1" in
'start')
	/usr/lib/snmp/mibiisa -r </dev/null >/dev/null 2>>&1 =
&
	;;

'stop')
	/usr/bin/pkill -9 -x -u 0 'mibiisa'
	;;

*)
	echo "Usage: $0 { start | stop }"
	exit 1
	;;
esac
exit 0

    The script should be installed in /etc/rc3.d and made = executable.=20

  6. Finally, you can start the daemon by hand (it will be started=20 automatically at next reboot if you installed the script in=20 /etc/rc3.d):=20 

    [2:45pm wally]# ./S99mibiisa start
[2:45pm wally]# ps -ef | grep mibiisa
    root 19762     1  0 11:55:35 ?        0:00 /usr/lib/snmp/mibiisa -r
[2:45pm wally]# lsof -i | grep snmp
mibiisa   19762    root    2u  IPv4 0x300011f8660       0t0  UDP *:snmp =
(Idle)

    If the daemon fails to start you should check the audit trail in=20 /var/log/syslog.

If you follow these = recommendations you=20 will have eliminated three daemons (snmpdx(1M), = dmispd(1M) and=20 snmpXdmid(1M)) and nine network entry points. You'll now have = only one=20 daemon (mibiisa(1M)) and one network entry point -- the = snmp=20 port serviced by that daemon. You will have made your system more = secure.=20
3DNB:=20 Caution: We suspect that this configuration may not answer as = many=20 SNMP requests as the default vendor configuration -- no = doubt=20 there are some requests which were answered in the vendor = configuration=20 by querying the DMI daemons we have eliminated. = There may=20 be additional security provided by the snmpdx(1M) daemon which we have=20 eliminated!=20

Reg Quinton, Information Systems and Technology
2000/10/04 -=20 2001/03/19
------=_NextPart_000_0009_01C16CE7.5F656410--