a. 自定义最小的非私有端口
ndd -set /dev/tcp tcp_smallest_nonpriv_port 2050
这样以来，0－2049都被定义为私有端口。
b. 用来显示已经定义的扩展私有端口
ndd /dev/tcp tcp_extra_priv_ports
c. 单独增加一个私有端口定义
ndd -set /dev/tcp tcp_extra_priv_ports_add 6112
d. 删除私有端口定义
ndd -set /dev/tcp tcp_extra_priv_ports_del 6112
e. 要注意的是，不要随便定义私有端口，因为有些非根权限的进程会使用这些端口。特别是改变最小非私有端口这个参数，
经常会引起问题。应仔细分析你的需求再用扩展私有端口定义的方式单独增加。
f. ndd /dev/tcp tcp_extra_priv_ports 执行结果（某系统）
2049
4045
9010
一共定义了3个私有端口
5.10 其他内核参数的调整
a. – Enable stack protection 直译为允许堆栈保护，应该使防止缓冲区溢出攻击
You should definitely add the following two lines to your /etc/system file:
set noexec_user_stack = 1
set noexec_user_stack_log = 1
b. – Prevent core dumps 避免核心内存转储
coreadm -d process
c. – Set limits on processes
6. 增强日志记录
Definitely tweak syslog.conf to capture
auth.info and daemon.notice msgs
? Create /var/adm/loginlog
? Additional levels of logging:
– System accounting (sar and friends)
– Process accounting
– Kernel level auditing (BSM)
7. 保护文件系统
? File systems should either be mounted
"nosuid" or "ro" (read-only)
? Set "logging" option on root file system
if you';re running Solaris 8 or later
? Don';t forget removable media devices:
– Turn off vold if possible
– Make sure rmmount.conf sets "nosuid"
8. 设置警告信息
两个文件 /etc/motd ;/etc/issue
– /etc/default/{telnetd,ftpd}
– EEPROM
– GUI Login
9. 加强系统的访问控制
9.1. 只允许root从console登陆
CONSOLE=/dev/console is set in /etc/default/login
sshd_config 里面设置 PermitRootLogin no
9.2. 禁止或删除不用的帐号
对不需要登陆的帐号，可将/etc/passwd文件中的shell选项修改为/bin/false 或者/dev/null
9.3. 创建/etc/ftpusers
在该文件中未指定的用户才能使用ftp服务
9.4. 禁止.rhosts支持
a. 删除系统中的.rhosts文件
b. 使用ssh的情况下，保证sshd_config文件中("IgnoreRhosts yes")
c. /etc/pam_conf and remove any lines containing rhosts_auth, even if you';ve disabled rlogin/rcp.
9.5. 限制对cron和at的访问
cron.allow and at.allow列出有权运行提交修改cron和at任务的用户
9.6. 设置eeprom到安全模式
Setting "eeprom security-mode=command" will cause the machine to prompt for a password
before boot-level commands are accepted. This prevents attackers with physical access from booting from
alternate media (like a CD-ROM) and bypassing your system security.
9.7. 限制xdmcp,设置锁定屏幕的屏保
If you';re running X Windows on the machine, make sure to disable remote XDMCP access in
/etc/dt/config/Xaccess. You may also want to set a default locking screensaver timeout for your
users in /etc/dt/config/*/sys.resources.
10. 安装安全工具
10.1 至少的安全工具
– SSH
– TCP Wrappers
– NTP
– fix-modes
10.2 增强工具
– Tripwire, AIDE, etc.
– Logsentry (formerly Logcheck) or Swatch
– Host-based firewall, Portsentry, etc.
