What's New in TITAN 4.0

 

Many of you have asked for a "changes document" to see if its worth loading newer versions of Titan . Also so your local diffs can be incorporated better.  Well here it is!

Authors note: If you make local changes to Titan, think about sending them to us for incorporating into the next release!
Titan isn't a commercial product, and we are happy to incorporate changes, as long as you don't want to get paid for the contributions, except maybe in beer.  -bpowell

3.6
More Solaris 8 features;

syslog2.6.sh added. This script turns on the "-t" flag new in solaris 2.8 syslogd. This flag blocks syslogd from accepting remote UDP keeping bad-guys from flooding your syslog. This should NOT be run on the  remote LOGHOST system.

utmp.sh  and utmp2.7.sh were updated to report correctly on utmpx instead of utmp.  Utmp is gone from solaris 2.7 and newer.

adjust-arp-timers2.8.sh was added. Some of the arp flags changed because of /dev/arp being added. (ndd -set /dev/arp instead of /dev/ip)

minimizeOS.sh added. minimizeOS takes a config (thus its not in the "modules" directory) and does a check using pkginfo to see which packages should be removed based on the system's use. "Minimize -c mailserver" would check/remove all the packages not required on a "sendmail server" This work is gleened from the OS minimization blueprint articles by Alex Noordergraff and Keith Watson of Sun. Please send any configuration scripts you create for inclusion into the Titan library.

 
3.5
The need to have the ucb packages be installed for titan to run has been eliminated. The SUNWbcp (UCB utilities) is no longer needed. All the Titan modules now use standard Solaris (SVR4)  utilities.

Titan now supports Solaris version 8. All the scripts have been updated to apply to Solaris 8 file locations.

Modules changed:
All modules have had the PATH variable changed to not look for /usr/ucb.

fix-modes.sh now uses version 1.39 of secure modes. The fix-modes.sh module now looks to see if the system is solaris 8 and runs the latest secure-modes binary. All older releases (solaris 2.1-2.7) will use secure-modes.[sparc|x86]-sol5.

fix-stack.sh was modified to use SVR4 chown (chown uid:gid instead of uid.gid) instead of UCB chown.

ziplock.sh was modified to use SVR4 chown (chown uid:gid instead of uid.gid) instead of UCB chown

disable-accounts.sh was modified to use /bin/mailx instead of using /usr/ucb/mail.

3.4

Bug Fixes
Some minor fixes were made to many modules to clean things up an fix some some minor bugs mostly having to do with inconsistent reporting.

This should be the most stable release of titan ever.

Enhancements
A fully new version of backtit.sh and untit.sh was incorporated. These new versions us a SAVEFILE variable in each of the Titan modules. This handles the problems of hangs on special character files and pipes that the old backtit.sh sometimes had.

All modules in version 3.4 were changed adding in the SAVEFILE variable.

Many modules were modified such that their output would be more consistent.

New modules:
inetsvc.sh. This modules turns off support for DHCP, named, and multicast. This helps performance, on systems that don't need or require these services running (static desktops and most servers) and keeps them safe from calls to these services.

automount2.sh. This is a simplified version of the automounter.sh module. It simply renames the /etc/rc2.d/S74automount module to keep it from running automounter at system startup.

3.2.2

Bug fixes:

BUG- disable-accounts.sh typo on line 149 caused the root account to also be disabled when run "-f" . A "\" should have been a "|". Sorry about that. Its fixed now.

Enhancements:

disable-NFS-2.6.sh released. This version takes advantage of Solaris being able to make single ports privileged instead of just a range. We use tcp_extra_priv_ports and udp_extra_priv_ports as well as the  udp_extra_priv_ports_add and tcp_extra_priv_ports_add command to only modify the specific ports we need. This is also a great way to do things like making your sybase or ace-server ports become privileged.

disable-NFS.bind.sh was modified to check for Solaris 2.5.1 or older, and only run on the older Solaris releases. Newer Solaris releases use the disable-NFS-2.6.sh module.

runas.c was enhanced to allow the optional "run not only as UID/GID foo" but also run in a chroot environment. Older versions of runas are now named runas-v2.c and runas-v1.c

3.2.1

Bug Fix only release:

Bug- ftp-2.6_secure.sh used forward apostrophes (') instead of back ticks (`) this caused the ftp banner to display "/bin/cat /etc/ftp-banner" instead of the real warning banner.

Bug- inetd2.sh  was a port from the sunOS 4.1.4 inetd.sh. This version was more restrictive, but had the path set to "/etc/in.telnetd" instead of "/sbin/in.telnetd"  This disabled  even the allowed services.

Bug- disable-accounts.sh suggestion to have the code check to see if the account shell was already "noshell" and if so leave it alone. Minor improvement, but worth doing.

3.2

Additions:

A new src1/Makefile.linux was added.
This is the beginnings of the linux port. The runas and noshell source works fine under linux using this new Makefile.

nddconfig.sh and lib/nddconfig were added.
Thanks to Keith Watson, (kaw@Eng.Sun.COM) these modules extend the existing ndd scripts (disable_ip_holes.sh, adjust-arp-timers.sh, adjust.syn-timeout.sh) to a fuller list of kernel network tunable parameters that can be Titan'ed  to enhance security.


Mitko Stoyanov donated the following modules which have been incorporated (with minor changes) into Titan.


Bug FIX's
userumask.sh , keyserv.sh,  decode.sh,  adjust-arp-timers.sh.

3.1.3

Additions:
Added in a new module ftp-2.6_secure.sh. This module adds a default umask to ftp so that files get created sanely by ftp (no more 666) It
also adds in a (short) ftp warning banner. I would have just liked to link  this to /etc/issue, but there seems to be a size limit (256?) before
the banner overflows into the login. Caution- If you modify this script to reset the UMASK value to something else take care you don't reset
the permissions to something less secure (creating mode 4777 files with ftp would be a bad thing!)

A new runas.c was added. The old one was left in for comparison sake.

A new cde.sh module was added.

A second more restrictive inetd.sh module was added called inetd2.sh

Fixes:
The inetd.sh was fixed. In some occasions the Fix( ) routine was not fully changing /etc/inetd.conf. This has been corrected

Some more documentation cleanup
 

3.1

Additions:

Added in a new module: rmmount.sh. This module is not needed if you disable vold, but on desktop systems where vold is allowed to run, this module stops CD's and Floppy Disks from being able to be mounted with suid binaries on them; e.g., if I have physical access to your system and can place  a floppy disk into the disk drive and that floppy contains a copy of some shell mode 4755 owned by "root"; then get vold to mount the disk for me; viola
I'm root on the local system. This new module stops vold from allowing this.

Added in a new C source code "runas.c" This is a simple mechanism that allows you to wrapper daemons to run as a different uid than root.
its the moral equivalent of doing a "su daemon -c /usr/lib/nfs/statd" thus starting the statd as user daemon. The difference is that using "su"
to start a daemon means that "daemon'" must have a valid shell in /etc/passwd. We try to limit system utilities use of the shell because of
rhosts, hosts.equiv, .shosts, as well as suid binaries and buffer overflows. Additionally  "runas" checks that it was executed as root, strips off any
environment settings, changes the uid, and executes the command. We tried to keep things as clean and simple. as possible.

A few assumptions need to be stated for use of runas:
 


    Note- starting daemons such as http in a chrooted environment and under a separate uid is preferable. Do that whenever possible. See Wietse's chrootid.c for details.

Example runas use:

                         Change /etc/rc2.d/S73nfs.client
                                FROM
                                                /usr/lib/nfs/statd > /dev/console 2>&1
                                TO
                                                /sbin/runas 3  100 /usr/lib/nfs/statd > /dev/console 2>&1

This would start up statd as user ID "3" (daemon) and group ID "100"

Fixes in 3.1.3:

1) Documentation fixes. Replaces grammatical errors
2) Bug fixes: minor clean up in a few scripts so that reporting was consistent.
 

3.1 changes: 3.1 was mainly a bug fix release, and the scheduled monthly update. Very little functionality changes.
Fixes:
 1) The disable_ip_holes was modified because Sun changed the syntax and added  in a variable "$forwarding" in /etc/rc2.d/S69inet which wasn't a "0" or a  "1" which Titan was expecting; thus it broke the titan script.
        Now Titan uses ndd to check things; this makes it work with all solaris releases and it becomes more generic in nature. It also means we can change the setting without a reboot required.
        2) Some changes to the sample.config scripts were made to make them more readable and to reference the new 3.0.5 modules.
        3) some other minor bug fixes.
 
 
 

3.0.5

        1) Additions :
            New modules Solaris 2.X:

                    aset.sh, bsm.sh, telnet-banner.sh   contributed by <jason.rhoads@sabernet.net>
                    see the standard documentation for details.

                    enhancement - userumask.sh now allows you to set the UMASK variable in a single location
                                                in the script. So you can set whatever umask your local security policy dictates.
 
 

    2) Bug Fixes:


            Solaris 2.X:

                                Bug Fix - disable-L1-A.sh.  modified the write/quit in the ed portion of the Fix()
                                                                                Also now recognized Solaris 7 (actually uname -r calls it 5.7)

                                Bug Fix -  fix-modes.sh now does a $MODES after doing the "$MODES -f " so that the
                                                    /var/sadm/contents file get written properly

                                Bug Fix - smtpbanner-8.8.sh now recognized Solaris 7 (actually uname -r calls it 5.7)

                                Bug Fix - snmpdx-2.6.sh. now recognized Solaris 7 (actually uname -r calls it 5.7)

                                Bug Fix - dmi-2.6.sh now recognized Solaris 7 (actually uname -r calls it 5.7)

                                Bug Fix -  disable-core.sh now recognized Solaris 7 (actually uname -r calls it 5.7)

                                Bug Fix -  pam-rhosts-2.6.sh now recognized Solaris 7 (actually uname -r calls it 5.7)

                                Bug Fix -  smtpbanner-8.8.sh now recognized Solaris 7 (actually uname -r calls it 5.7)

                                Bug Fix -  snmpdx-2.6.sh now recognized Solaris 7 (actually uname -r calls it 5.7)

                                Bug Fix -  fix-stack.sol2.6.sh now recognized Solaris 7 (actually uname -r calls it 5.7)
 
 
 

            Solaris 4.X:

                Cleaned up the output so that it doesn't report "Check #6" and such.

                Note: There are a lot of Solaris 4.1.X modules that I identified as being needed, but since
                          Solaris 4.1.X isn't going to be Y2K certified, I haven't written them. If there is anyone
                          using Solaris 4.1.X that really wants the changes, I'll incorporate them - bpowell