system without a password:
ok boot cdrom
Once the system has booted from the CD-ROM drive, a number of options are available to the intruder:
Do an ftp on any file on the system to a remote system.
Copy any file on the system to a mass storage device (such as a DAT tape).
Format all of the drives on the system.
Launch a distributed denial of service attack against other networks, which you will be blamed for.
Of course, the possibilities are endless, but the result is the same. You may ask why it is so easy to compromise a system in this way: one good reason is that if you forget your root password, you can boot from the CD-ROM, mount the boot disk, and manually edit the shadow password file.
This requirement doesn’t really excuse poor security, and the OpenBoot monitor provides some options to secure the system. There are three security levels available:
None Surprisingly, this is the default. No password is required to execute any of the commands in OpenBoot. This is convenient but dangerous, for the reasons outlined earlier.
Command This level needs a password to be entered for all commands except boot and go. Thus, details of the SCSI bus and network traffic can’t be observed by the casual browser, but an intruder could still boot from the CD-ROM.
Full This level requires a password for every command except go, including the boot command. Thus, even if the system is interrupted and rebooted using the boot command, only the default boot device will be available through go.
To set the security level, the eeprom command is used. To set the command level, use the following command:
# eeprom security-mode=command
Alternatively, to set the command level, use the following command:
# eeprom security-mode=full
The password for the command and full security levels must be set by using the eeprom command:
# eeprom security-password= Changing PROM password: New password: Retype new password:
Note that if the root password and the full-level password are lost, there is no way to recover the system by software means: a new PROM will need to be ordered from Sun.
The first step in network security is to prevent unauthorized entry by disabling access to specific IP ports, as defined by individual entries in the services database. This action prevents specific services from operating, even if the inetd attempts to accept a connection for a service because it is still defined in /etc/inetd.conf. In this section, we will examine how to disable specific services from inetd, in conjunction with the services database.
The following services are typically enabled in /etc/services and configured in /etc/inetd.conf. Most sites will want to disable them, and install more secure equivalents. For example, the ftp and telnet services may be replaced by the encrypted secure copy and secure shell programs, respectively. To disable the ftp, telnet, shell, login, exec, comsat, talk, uucp, and finger services, we would “comment out” their entries in /etc/inetd.conf by inserting a hash character “#” at the first character position of the line that defines the service. The following configuration enables the ftp, telnet, shell, login, exec, comsat, talk, uucp, and finger services in /etc/inetd.conf:
ftp stream tcp nowait root /usr/sbin/in.ftpd in.ftpd -l telnet stream tcp nowait root /usr/sbin/in.telnetd in.telnetd shell stream tcp nowait root /usr/sbin/in.rshd in.rshd login stream tcp nowait root /usr/sbin/in.rlogind in.rlogind exec stream tcp nowait root /usr/sbin/in.rexecd in.rexecd comsat dgram udp wait root /usr/sbin/in.comsat in.comsat talk dgram udp wait root /usr/sbin/in.talkd in.talkd uucp stream tcp nowait root /usr/sbin/in.uucpd in.uucpd finger stream tcp nowait nobody /usr/sbin/in.fingerd in.fingerd
The following configuration disables the ftp, telnet, shell, login, exec, comsat, talk, uucp, and finger services in /etc/inetd.conf:
#ftp stream tcp nowait root /usr/sbin/in.ftpd in.ftpd -l #telnet stream tcp nowait root /usr/sbin/in.telnetd in.telnetd #shell stream tcp nowait root /usr/sbin/in.rshd in.rshd #login stream tcp nowait root /usr/sb