Ejemplo report.hml

1. x86 BIOS Fix: Consult the hardware vendor’s documentation to determine how to start the system and access the BIOS controls. Access the system’s BIOS or system controller. Set an administrator password if one has not been set. Disable a user-level password if one has been set.
2. x86 GRUB Fix:
   1. Set the GRUB menu password:

                    # bootadm set-menu-password
                    Password: xxxxxxxx
                    Re-enter password: xxxxxxxx
                      

   2. Or add users and set auth entries for all GRUB menu items.

                    # bootadm set-menu add-user=[username]
                    Password: xxxxxxxx
                    Re-enter password: xxxxxxxx
                    # bootadm change-entry -i 0 add-auth=[username]
                      

3. SPARC eeprom fix: The security mode should be command or full:

             # eeprom security-mode=command
             Changing PROM password:
             New password: xxxxxxxx
             Retype new password: xxxxxxxx
               

Enable the PF firewall service with SMF. Also, ensure that you have a reasonable rule set for the server in question.

This check looks for at least one rule that starts with the «block» keyword, which should appear in most production rule sets.

See the pfctl(8) and pf.conf(7) man pages for examples.

1. Configure Packet Filter by adding rules to the /etc/firewall/pf.conf file by using the pfedit(8) command.

               # pfedit /etc/firewall/pf.conf
               ...
               block in log proto tcp from any to any
               pass in quick proto tcp from any to any port = 80
               pass out quick proto tcp from any to any flags S/SA keep state
               ...
               

2. Enable the packet filter service.

               # svcadm enable  svc:/network/firewall:default
               

1. Create an /etc/hosts.deny file containing the one line:

             ALL:ALL
               

2. Create an /etc/hosts.allow file containing those connections which you want to allow. For detailed instructions, see the hosts_access(5) and tcpd(8) man pages.

1. Back up any data needed from any unencrypted non-root file system.
2. Unmount and destroy those offending file systems.
3. Re-create the file systems with encryption on (default algorithm is aes-128-ccm).
4. Restore data (preserved earlier) to the file systems, or use shadow migration to load data into the encrypted file system.

    # pfedit /etc/vfstab
    ...
    swap  -  /tmp  tmpfs  -  yes  size=sz
    # svcadm restart filesystem/local
        

Configure the core files and protect the core dump directory.

      $ coreadm
           global core file pattern: /var/cores/core.%z.%f.%u.%p
           global core file content: default
      kernel zone core file pattern: /var/cores/kzone.%z.%t
             init core file pattern: core
             init core file content: default
                  global core dumps: enabled
             kernel zone core dumps: enabled
             per-process core dumps: enabled
            global setid core dumps: disabled
       per-process setid core dumps: disabled
           global core dump logging: disabled
              diagnostic core dumps: enabled
                   retention policy: summary
              core diagnostic alert: enabled
          

To set the correct coreadm(8) configuration:

        # coreadm -g default -k default \
        -e global -e kzone -e process \
        -e diagnostic -e alert -d global-setid \
        -d process -d log -d proc-setid
          

To check the permissions:

        # ls -ld /var/share/cores
        drwx------   2 root     sys           2 Nov  2  2014 cores/
          

To set the permissions correctly on the directory:

        # chmod 700 /var/share/cores
          

Check the core file monitoring service is online using the following command:

        svcs -l svc:/system/coremon:default
          

and enable it as necessary using the svcadm(8) command.

As needed:

        # pkg install service/network/ntp
        # pfedit /etc/inet/ntp.conf
        ...
        server <server IP address> iburst
        restrict default ignore
        ...
        # svcadm enable ntp
          

1. To set the service to disabled run:

             # svcadm disable svc:/network/rpc/gss:default
               

To manually remediate this failure, set the service state to enabled using the appropriate command.

1. To set the service to disabled, run:

             # svcadm disable svc:/system/rad:remote
               

2. To set the service to enabled, run:

             # svcadm enable svc:/system/rad:remote
               

Configure your system to deny remote users permission to send messages to the terminal.

To manually remediate a failure on this check, run the following commands.

1. Add «mesg -n» to /etc/login

             # pfedit /etc/.login
             ...
             mesg -n
               

2. Add «mesg -n» to /etc/profile

             # pfedit /etc/profile
             ...
             mesg -n
               

Disable any unneeded services listening on the network.

        # svcadm disable <FMRI for unneeded service>
        

Additionally, rpcbind should be set to local only mode so that it does not respond to remote requests, using:

        # /usr/sbin/svccfg -s svc:/network/rpc/bind:default setprop config/local_only = boolean: true
        # svcadm refresh svc:/network/rpc/bind:default
        

To manually remediate this failure, set the service state to disabled using the appropriate command.

1. To set the service to disabled run:

             # svcadm disable svc:/application/cups/in-lpd:default
               

2. To set the service to enabled run:

             # svcadm enable svc:/application/cups/in-lpd:default
               

In order to restrict cron(8) and at(1) properly, the file /etc/cron.d/cron.allow should exist and have only one entry for root.

To manually remediate failure on this check, run the following commands.

1. Make sure root is the only entry in the /etc/cron.d/cron.allow

             # pfedit /etc/cron.d/cron.allow
               

   edit the file to only have «root»
2. Make sure the /etc/cron.d/at.allow file exists and is empty

             # pfedit /etc/cron.d/at.allow
               

      # pfedit /etc/proftpd.conf
      Umask         027
        

      # pfedit /etc/ssh/sshd_config
      X11Forwarding no

      # svcadm restart svc:/network/ssh
        

An administrator with the Audit Configuration rights profile can get and set audit parameters. This check validates that auditing is enabled for a recommended set of audit flags and root audit flags.

To manually remediate a failure on this check, you run the following commands:

1. Set the audit policy to «argv,cnt»

             # auditconfig -setpolicy argv,cnt
               

2. Set the user audit flags to «lo»

             # auditconfig -setflags lo
               

3. Set the non-attributable audit flags to «lo»

             # auditconfig -setnaflags lo
               

4. Set the audit plugin named «audit_binfile» to be active

             # auditconfig -setplugin audit_binfile active
               

5. Set root user’s audit flags to «cusa:no»
   If root is configured to be a role

             # rolemod -K audit_flags=cusa:no root
               

   Otherwise:

             # usermod -K audit_flags=cusa:no root
               

6. Refresh the audit service based on current properties

             # audit -s
               

Edit the /etc/default/passwd file, set the MINLOWER parameter to the policy minimum password lower-case character count, which is 1.

      # pfedit /etc/default/passwd
      MINLOWER=1
        

Edit the /etc/default/passwd file, set the MINSPECIAL parameter to the policy minimum password special character count, which is 1.

      # pfedit /etc/default/passwd
      MINSPECIAL=1