SGI Enlighten DSM 1.1

home *** CD-ROM | disk | FTP | other *** search

/ SGI Enlighten DSM 1.1 / SGI EnlightenDSM 1.1.iso / sol2x / common.z / common / config / suggestions < prev next >

Wrap

Text File | 1998-07-01 | 8.0 KB | 213 lines

1000 DUPLICATE UID Add users only through the Enlighten interface (from the User Configuration Screen), allowing Enlighten to select the next available userid by leaving that field blank. Control user account creation from a single source, rather than allowing full access to multiple administrators on a single host. This policy will provide better continuity of account assignments. Perform the Duplicate Userid test weekly, and after addition of many users (especially from the Multi-User Add window). 1010 DUPLICATE USERNAME Add users only through the Enlighten interface (from the User Configuration screen), allowing Enlighten to select the next available userid by leaving that field blank. Control user account creation from a single source, rather than allowing full access to multiple administrators on a single host. This policy will provide better continuity of account assignments. Perform the Duplicate Userid test weekly, and after addition of many users (especially from the Multi-User Add window). 1020 VULNERABLE DIRECTORIES Create user accounts through the Enlighten interface; it will make sure that the user's home directory is owned by the username of the account. When modifying account userid's (either directly or through Enlighten), be sure to change the ownership of the home directory and files within the directory to match the account change. 1030 EASY PASSWORDS Perform the Obvious Password check often. From the Security menu, you can select among several levels of testing. To reduce time commitments, you should set a schedule, doing the weakest security level check often, and the strongest security check on a regular but infrequent basis. Once a quarter send mail to all users stressing the importance of choosing a reasonably secure password, with suggestions on methods to improve the randomness. Possibilities include the use of at least one decimal digit and one capital or odd symbol in the password. Obtain a password assignment program that enforces password format policies. Immediately "Lock" users with obvious passwords and reinstate them on a demand basis. This action is recommended due to the fact that this area is so often used by undesirable parties to gain access. 1100 FULL DISKS Use ENlighten/Events to monitor file systems. Rebuild disk snapshots automatically at night, so information is relatively up-to-date, reducing the need to request online rebuilds. Inform users of company policy regarding placement of large files. It is unwise to use volatile file systems, especially temporary space ("/tmp"), as semi-permanent file storage areas. Separate these file systems, and provide frequent user backups. 1110 SETUID PROGRAMS When installing new or updated programs, check files for the set-uid permission mode. Maintain a list of known set-uid programs as a basis for later comparison. Perform the Enlighten check for set-uid files fairly often, as the propensity for infection and spread through software "virus" by these programs is high. 1120 DEVICES NOT IN "/dev/" Perform a File Search for such files on a regular basis. Remember to rebuild the snapshots as not to check the same data again. To perform the search, find files of type "Block Special" and "Character Special", and Skip Filenames like "/dev/*". The files found in the resulting search should be carefully scrutinized. Try to determine who created them and for what purpose. One might want to delete them or, change their ownership to root and their permissions to 700. On some UNIX 5.4 systems, such as SOLARIS 2.x, a secondary device directory "/devices" exists. This directory, if on a UNIX 5.4 system, is considered to be a legal repository for device files. Consequently, in the File Search, filename like "/devices/*" should also be skipped. 1130 SYSTEM EXECUTABLES Create a special master (known state of the universe) disk snapshot for each system early in your use of Enlighten. Maintain this snapshot on backup tape for later reference, to use as a clean basis for comparison of system changes. Update the basis snapshot only when you know the system is consistent and clean. Perform the Enlighten check often. Pay particular attention to files which grow without apparent cause; viral infection of these files is a possibility. 1200 DOWN PRINTERS Give print queues names which associate the type of queue (its purpose) and the printer to which it belongs. It will then be easier to tell which print queues share a printer, and thus which should be disabled when certain shared queues are enabled. 1210 LONG PRINT QUEUES Generate a printing policy regarding large print jobs. Inform new users of the policy. Maintain multiple compatible printers, in order to transfer jobs and balance the queues. 1220 LARGE PRINT JOBS From the Queue Screen, with inappropriate print jobs selected, choose the Mail icon and send a letter to the print job owners regarding printing policy. Review the queues and survey your users periodically to determine the type of printing mix required. If more image or volume jobs are required, consider purchasing appropriate printers for the tasks. Create nightime-only print queues, and encourage users to take advantage of them for volume print jobs. 1300 SERVERS UP Keep track of server down time and the causes (if trace information is available from system logs). Patterns might emerge from the historical data. 1310 SWAP SPACE Create a policy for computer resource usage, especially regarding game and image-related programs. Processes tend to grow in efficient ways over time, causing system stress. Suggest that users exit out of resource-intensive programs periodically. This will allow the programs to free their resources and allow the system to reallocate resources more efficiently when the programs are restarted "Cute" programs should be discouraged on production systems. 1400 HOST ADDRESS CONFLICT The hosts database, which contains a list of known hosts and their associated IP addresses, has been tested for host names which are associated with more than one IP address. For host names which are found to have more than one IP address associated with them, you must decide which address is the correct one. You can then use the Host Configuration menu to modify the selected host entries. Either modify the selected host entries to have the proper address, or copy the correct address to each host which has an incorrect address. Run the Enlighten Expert on a regular basis to check for host address conflicts. 1410 HOST NAME CONFLICT The hosts database, which contains a list of known hosts and their associated IP addresses, has been tested for host IP addresses which are associated with more than one host name. For host IP addresses which are found to have more than one host name associated with them, you must decide which host name is the correct one. You can then use the Host Configuration menu to modify the selected host entries. Either modify the selected host entries to have the proper name, or copy the correct host name to each host which has an incorrect name. Run the Enlighten Expert on a regular basis to check for host name conflicts. 1420 HOST ALIAS CONFLICT The hosts database, which contains a list of known hosts and their associated IP addresses, has been tested for host aliases which are associated with more than one host name. For host aliases which are found to have more than one host name associated with them, you must decide which host has the right to use the given alias. You can then use the Host Configuration menu to modify the selected host entries. For example, modify the selected host entries to have the proper alias. Run the Enlighten Expert on a regular basis to check for host alias conflicts.