Configuring the Network

At this point, you might have created users who can assume roles, and have created the roles. Only the root role can modify system files.

From the following network tasks, perform the tasks that provide additional security according to your site requirements. These network tasks notify users who are logging in remotely that the system is protected, and strengthen the IP, ARP, and TCP protocols.

Task	Description	For Instructions
Display warning messages that reflect your site's security policy.	Notifies users and would-be attackers that the system is monitored.	How to Display a Security Message to `ssh` Users
Disable the network routing daemon.	Limits access to systems by would-be network sniffers.	How to Disable the Network Routing Daemon in Securing the Network in Oracle Solaris 11.1
Prevent the dissemination of information about the network topology.	Prevents the broadcast of packets.	How to Disable Broadcast Packet Forwarding in Securing the Network in Oracle Solaris 11.1
	Prevents responses to broadcast echo requests and multicast echo requests.	How to Disable Responses to Echo Requests in Securing the Network in Oracle Solaris 11.1
For systems that are gateways to other domains, such as a firewall or a VPN node, turn on strict source and destination multihoming.	Prevents packets that do not have the address of the gateway in their header from moving beyond the gateway.	How to Set Strict Multihoming in Securing the Network in Oracle Solaris 11.1
Prevent Denial of Service (DOS) attacks by controlling the number of incomplete system connections.	Limits the allowable number of incomplete TCP connections for a TCP listener.	How to Set Maximum Number of Incomplete TCP Connections in Securing the Network in Oracle Solaris 11.1
Prevent DOS attacks by controlling the number of permitted incoming connections.	Specifies the default maximum number of pending TCP connections for a TCP listener.	How to Set Maximum Number of Pending TCP Connections in Securing the Network in Oracle Solaris 11.1
Generate strong random numbers for initial TCP connections.	Complies with the sequence number generation value specified by RFC 6528.	How to Specify a Strong Random Number for Initial TCP Connection in Securing the Network in Oracle Solaris 11.1
Return network parameters to their secure default values.	Increases security that was reduced by administrative actions.	How to Reset Network Parameters to Secure Values in Securing the Network in Oracle Solaris 11.1
Add TCP wrappers to network services to limit applications to legitimate users.	Specifies systems that are allowed access to network services, such as FTP.	How to Use TCP Wrappers.

How to Display a Security Message to `ssh` Users

Use this procedure to display warnings when logging in using the ssh protocol.

Before You Begin

You created the /etc/issue file in Step 1 of How to Place a Security Message in Banner Files.

You must become an administrator who is assigned the solaris.admin.edit/etc/ssh/sshd_config authorization and one of the Network rights profiles. The root role has all of these rights. For more information, see How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.

To display a security message to users who are logging in by using ssh, do the following:
1. Uncomment the Banner directive in the /etc/sshd_config file.
```
$ pfedit /etc/ssh/sshd_config
# Banner to be printed before authentication starts.
Banner /etc/issue
```
2. Refresh the ssh service.
```
# svcadm refresh ssh
  
```
For more information, see the issue(4), sshd_config(4), and pfedit(1M) man pages.

How to Use TCP Wrappers

The following steps show three ways that TCP wrappers are used or can be used in Oracle Solaris.

Before You Begin

You must assume the root role to modify a program to use TCP wrappers.

You do not need to protect the sendmail application with TCP wrappers.
By default, it is protected with TCP wrappers, as described in Support for TCP Wrappers From Version 8.12 of sendmail in Managing sendmail Services in Oracle Solaris 11.1.
To enable TCP wrappers for all inetd services, see How to Use TCP Wrappers to Control Access to TCP Services in Configuring and Administering Oracle Solaris 11.1 Networks.
Protect the FTP network service with TCP wrappers.
1. Follow the instructions in the /usr/share/doc/proftpd/modules/mod_wrap.html module.
  Because this module is dynamic, you must load it to use TCP wrappers with FTP.
2. Load the module by adding the following instructions to the /etc/proftpd.conf file:
```
<IfModule mod_dso.c>
    LoadModule mod_wrap.c
</IfModule>
```
3. Restart the FTP service.
```
$ svcadm restart svc:/network/ftp
```

Skip Navigation Links
Exit Print View
	Oracle Solaris 11 Security Guidelines Oracle Solaris 11.1 Information Library