This README file explains the armor script and what it does. Please
email all your corrections, recommendations, and flames to 
lance@spitzner.net.

WHAT ALL THE FILES ARE FOR
--------------------------

COPYING		- GPL license
CREDITS		- Alot of great people helped out on this
README.1st	- This file
armor		_ The executable script file that armors your system.
inetd.conf	- New /etc/inet/inetd.conf file
inetint		- New /etc/default/inetinit file 
readme.tcp	- The readme file that comes with TCP Wrappers.
syslog.conf	- New /etc/syslog.conf file, configured for TCP Wrappers
tcpd.i386	- TCP Wrapper binary for x86
tcpd.sparc	- TCP Wrapper binary for Sparc



PURPOSE:
---------

I grew tired of manually armoring an operating system everytime I 
installed a firewall.  Being the lazy bum that I am, I decided to 
script the whole process.  This script is the result of that work.
The purpose of this script is to armor a new installation of Solaris
2.5.1, 2.6, or 2.7 Sparc or x86.  I recommend this script for new 
systems only.  


WHAT DOES IT DO:
------------------

This script is based on my article "Armoring Solaris" at
http://www.enteract.com/~lspitz/armoring.html.  The script
armors a new installation of Solaris, Sparc or x86.



HOW DO I EXECUTE THE FILE
--------------------------

First, you MUST be on the system console to implement this script.
DO NOT telnet to the system and execute the armor script, you may
lock youself out!

Second, you must be root to execute the script.

Unpack the tar file and ensure all the files are in the same dir.
I recommend using the following syntax to launch the script.

./armor | tee <filename>

Where <filename> is the name you want to store the results in.
This will casue STDOUT to both the console and save to <filename>.

If you are concerned about what the script does, just 
edit the armor file for your system.  You can easily comment out 
any actions you do not want, or add your own.  You will notice 
the liberal use of echo commands in the armor script.  I did this 
for debugging purposes.  In case something does go wrong, you will 
know exactly where it happened.

NOTE: Any time a file is modified, the modified file is first 
backed up as <filename>.orig. Example, a backup copy of 
/etc/inet/inetd.conf is /etc/inet/inetd.conf.orig.


---- WHAT THE SCRIPT DOES ----


1. WHEEL GROUP
Creates the group wheel in /etc/group and changes the group ownership 
of the su binaries to wheel.  This means only root and memebers of
the wheel group can su.  This controls who can gain access to root.

2. SERVICES IN INETD
Eliminates all the services that /usr/sbin/inetd listens for except
telnet and ftp.  This is done by commenting out services in
/etc/inet/inetd.conf.

3. FTPUSERS
Limits who has ftp access to the system.  Whatever accounts are listed
in the file /etc/ftpusers cannot ftp to the system.  This script will
automatically put all accounts into the file, you will have to 
manually remove  any accounts you want to have ftp access.

4.  TELNET & FTP BANNERS
Eliminates the "SunOS 5.6" banner when someone telnets to the system.
Also creates a banner and umask setting for ftp users.  Check the
config files /etc/default/ftpd and /etc/default/telnetd for more 
info.

5. LOGIN BANNER
Creates a login banner for any user who telnets to the system.  The
banner is located at /etc/issue and can easily be modified.

6. TCP WRAPPERS
Automatically detects if you are running Sparc or x86 and installs
the proper TCP Wrapper binary at /usr/local/bin.  Also modifies 
/etc/syslog.conf for TCP Wrapper logging.  Modifies /etc/inet/inetd.conf
to wrap the services in.telnetd and in.ftpd.  Also adds /etc/hosts.allow
and /etc/hosts.deny, however you will have to modify these.  For more
information, see readme.tcpd.  You can find the source at 
http://www.porcupine.org.


7.  SERVICES
Identifys uneeded services in /etc/rc scripts and turns them off
by changing the Capital S to a small s.

8.  TRUST RELATIONISHIPS
Protects against trust relationships by creating empty /.rhosts, 
/.netrc, and /etc/hosts.equiv file then chmod 0.

9.  LOGGING
Enables additional logging by creating the following logging files.
/var/adm/sulog    - logs all su attempts
/var/adm/tcpdlog  - logs all TCP Wrapper connections
/var/adm/loginlog - logs any login attempt that fails 5 
                    consecutive times.
/var/adm/inetdlog - logs all inetd connections

10.  TCP SEQUENCE NUMBER GENERATION
Randomizes the initial sequence number for all TCP connections.  See
RFC 1948 for more info.

11.  MODIFY IP OPTIONS IN /DEV/IP
On reboot, ndd will modify your ip kernel module.  It will no longer
repsond to broadcasts or timestampt and no longer forward broadcast
requests.  For more info, see ndd(1M).


Please send your corrections, recommendations, and flames to 
Lance Spitzner at lance@spitzner.net
http://www.enteract.com/~lspitz/papers.html


