Solaris Security Toolkit Customization

Customizing Solaris Security Toolkit

The Solaris Security Toolkit provides a flexible way to harden a Solaris system, making it more secure from malicious attack. This software may be installed during a unattended Solaris JumpStart install, or installed after Solaris is installed and booted. Solaris Security Toolkit supports Solaris 8, 9, and 10 on SPARC and x86 systems. Solaris 2.5.1, 2.6, and 7 can be used, but are not supported.

One size does not fit all. The degree of hardening depends on your site requirements. For that reason, pre-canned scripts provide various levels of hardening. The secure.driver closes all ports except for ssh. The server-secure.driver leaves frequently-used server services open. The following discusses customizing the server-secure.driver to your site-specific needs. Once customized, your systems can be hardened in an automated way using one or more configurations you established.

Usage and Customization Example

I won't go into all the details of use and customization of Solaris Security Toolkit, but I'll give enough details to get you started. I'm only covering interactive use in this example. For unattended JumpStart installs, see the Administration Guide.

1. First, download the SUNWjass package, available at no cost at http://www.sun.com/software/security/jass/. You don't need the MD5 (SUNBEmd5) or fixmodes (SUNBEfixm) packages, as the functionality is incorporated in Solaris 10.
2. If SUNWjass is already installed, remove it with pkgrm (back up any modified files first)
3. Uncompress and install the package to /opt/SUNWjass:

   # uncompress SUNWjass.pkg.Z # pkgadd -d SUNWjass.pkg

4. Run a driver in "apply" mode. In this example, we use server-secure.driver This takes a few minutes. Other drivers are covered in the security_drivers(7) man page and Reference Manual.

   # /opt/SUNWjass/bin/jass-execute -d server-secure.driver

5. Check the summary output for failures and errors:

   [SUMMARY] Results Summary for APPLY run of server-secure.driver [SUMMARY] The run completed with a total of 85 scripts run. [SUMMARY] There were Failures in 0 Scripts [SUMMARY] There were Errors in 0 Scripts [SUMMARY] There were Warnings in 2 Scripts [SUMMARY] There were Notes in 68 Scripts

6. Reboot and login again:

   # /usr/sbin/reboot

7. You can verify the previous run of jass-execute ("audit" mode) was correct:

   # /opt/SUNWjass/bin/jass-execute -a server-secure.driver

   This takes a few minutes and produces a summary at the end:

   [SUMMARY] Results Summary for AUDIT run of server-secure.driver [SUMMARY] The run completed with a total of 85 scripts run. [SUMMARY] There was a Failure in 1 Script [SUMMARY] There were Errors in 0 Scripts [SUMMARY] There was a Warning in 1 Script [SUMMARY] There were Notes in 20 Scripts [SUMMARY] Failure Scripts listed in: /var/opt/SUNWjass/run/20050721092746/jass-script-failures.txt

   Verify there are no failures. If any failures are found, look at the script output to see if there are any unexpected problems. In the example above, I see the failure is from set-root-home-dir.aud because I provided a created a custom .profile script:

   [FAIL] Template /root/.profile does not match target on system.

   I can ignore the error or fix it by removing my custom .profile file, or modifying the .profile in Solaris Security Toolkit (under /opt/SUNWjass/Files).
8. Determine if any services have been disabled that you may need or if you wish to disable more services. Use tools such as netstat -an, svcs, and nmap. See the Administration Guide for a detailed approach.
9. In this example, we see telnet is running from svcs and wish to disable it:

   # svcs telnet STATE STIME FMRI online 9:06:31 svc:/network/telnet:default

10. To disable telnet, add the FMRI svc:/network/telnet:default to JASS_SVCS_DISABLE in /opt/SUNWjass/Drivers/user.init Use the package-provided file user.init.SAMPLE as a template

    # cd /opt/SUNWjass/Drivers # cp user.init.SAMPLE user.init # cat >>user.init JASS_SVCS_DISABLE="svc:/network/telnet:default" export JASS_SVCS_DISABLE ^D

    To enable a service that was disabled, use JASS_SVCS_ENABLE (if the service was listed in JASS_SVCS_DISABLE) or disable the appropriate finish script in /opt/SUNWjass/Finish/*.fin. For details see the Reference Manual and Administration Guide.
11. To apply the change run jass-execute in apply mode again and reboot:

    # /opt/SUNWjass/bin/jass-execute -d server-secure.driver

    If you want a service enabled that was previously enabled, you need to undo the previous run of jass-execute in Apply mode. To do run this and reboot:

    # /opt/SUNWjass/bin/jass-execute -u

 # /opt/SUNWjass/bin/make-jass-pkg