|
Softpanorama
(slightly skeptical)
Open Source Software Educational Society |
May the
source be with you,
but remember the KISS principle ;-)
|
Security Hardening for Tivoli servers
Tivoli servers
need to have higher security hardening. Companies,
which install Tivoli to resolve a systems management or even to improve security
often forget that the systems that belong to Tivoli infrastructure need to be
properly configured and hardened. The latter should go
beyond
the basics (disable root login, using SSH )
NIST Enterprise System
Management Security Technical Implementation Guide should be used as
the blueprint.
Typically Tivoli is installed on AIX systems so
this is the question of AIX hardening. AIX
hardening is less developed then Solaris hardening. AIX
supports three modes of installation Normal, TCB and CC
mode of installs. The latter two: TCB(Trusted Computing Base) and Common
Criteria related mode of installs provide for an
hardened AIX systems. Please use following links for
hardening an AIX system:
1. Web based wizard to retrieve guidelines in
regards to hardening AIX security.
http://publib.boulder.ibm.com/eserver/v1r1/en_US/index.htm
(Click on "Security Planner" in the left frame.)
2. White paper:
http://www-1.ibm.com/servers/aix/whitepapers/aix_security.html
3. AIX security guide provides checklists and
guidelines in regards to securing AIX systems:
4. AIX security:
http://www-1.ibm.com/servers/eserver/pseries/security/
Additionally, the Access Manager for Operating
Systems product from Tivoli has a Fast Start Policy
Module (FSPM) for AIX, which creates a hardened
environment enforced by AMOS. See :
AIX 5L: Security Features & Standards - Thursday,
December 2, 2004
Notes:
- Those pages are written by people for whom English is not a
native language. Some amount of grammar and spelling errors
should be expected.
- This is a Spartan WHYFF (We Help You For Free) site. It
cannot replace the best teachers and
the
best books.
- The site contain some obsolete pages as it develops like a
living tree... Some links on older pages
are broken. Please
try to use Google, Open directory, etc. to find a replacement link
(see
HOWTO search the WEB for details).
We would appreciate if you can
mail us a correct link.
|
|
Orb Data - Technical
Audit
The lifecycle of an Enterprise Management project can
often be long and protracted. In fact, well beyond the
initial implementation phase, the project can still be
evolving as new requirements come to light and as the user
communities come to accept the new tools that are provided.
The initial stages of an Enterprise Management
implementation could be likened to the laying of the
foundations of the system, with the real prize of a fully
functioning management solution serving the enterprise just
around the corner. The foundation is normally established
with a solid business case, with clear objectives and a
coherent design.
As time goes by, however, it is often the case that
Enterprise Management systems are compromised due to a
number of factors, including change in the business, loss of
focus on the original business goals, unmanaged change to
the environment, or simply through the turnover of skilled
staff trained to operate and maintain the environment. This
can lead to ad hoc development outside of the bounds of the
original architecture, or in cases of neglect to the
disrepair of the environment. In such situations, it is wise
to cease further development and conduct a comprehensive
review of the system.
Whether you've run into problems with your environment,
or simply need an expert's opinion concerning your
environment, Orb Data can offer you a comprehensive review
in the form of a Technical Audit. This service offers a
'point in time' investigation detailing the configuration of
your environment, the use of the environment, the problems
contained within the environment, and a set of
recommendations to remedy the situation.
Scope.
The Technical Audit can be conducted in environments that
contain one or more Tivoli Managed Regions (TMRs), running
Tivoli Enterprise software of any version.
Deliverables.
You will receive a fully detailed report in two parts.
The first part will provide an overview of the current state
of the environment. This includes:
- An overview of the environment including server
configurations and software configurations, including
revision and patch levels
- Details of the Logical Design
- Details of the Administrators, their access rights,
and a description of what management functions they can
and can't perform
- Description of existing and potential problems (such
as poor system performance, or lack of routine
housekeeping), along with specific causes
The second part of the report will set out a series of
recommendations on how the environment can be remedied and
further developed to meet the objectives defined for the
Enterprise Management system. Additionally, at the
customer's request, Orb Data can scope out the resulting
work, and provide the technical skills necessary to
implement the changes.
Other areas of concern.
Our specialists can also perform similar audits on more
specific areas of your environment. These areas include, but
are not limited to:
- Tivoli Enterprise Console (TEC) server configuration
- TEC rule implementation
- RDBMS Interface Module (RIM) implementation,
performance and tuning
- Endpoint policy and management
- Gateway/Repeater configuration
- Source code management
In case of broken links
please try to use Google search. If you find the page please notify
us about new location
NIST Enterprise System
Management Security Technical Implementation Guide
Securing UNIX applications using Tivoli Access Manager for ...
This article explores how
Tivoli Access Manager for Operating Systems can be used for
security hardening of UNIX systems. It focuses on
securing UNIX
Copyright © 1996-2008 by Dr. Nikolai Bezroukov.
www.softpanorama.org was
created as a service to the UN Sustainable Development Networking Programme (SDNP)
in the author free time.
Submit
comments This document is an industrial compilation designed and created
exclusively for educational use and is placed under the copyright of the
Open Content License(OPL).
Original materials copyright belong to respective owners. Quotes are made
for educational purposes only in compliance with the fair use doctrine.
Standard disclaimer: The statements, views and opinions presented on
this web page are those of the author and are not endorsed by, nor do they necessarily
reflect, the opinions of the author present and former employers, SDNP or any other
organization the author may be associated with. We do not warrant the correctness
of the information provided or its fitness for any purpose.
Last modified:
June 02, 2008
