Show differences between LPAR Profile and Running configuration on IBM POWER servers

prdiff - Show differences between LPAR Profile and Running configuration on IBM POWER servers

http://prdiff.sourceforge.net/

Maintaining an AIX firewall

IBM quietly added a firewall capability (known as ipfilters) to AIX 6.1, however they did not do a particularly good job of either publicising or documenting it. You can either configure ipfilt from the command-line or via smit. The ipfilt toolset is part of the LPP: bos.net.ipsec.rte.

1. If you already have an .exp file make a copy of your firewall rules file (e.g. ipsec_fltr_rule.exp) and copy to a temporary directory, or export it as follows:

# expfilt -v4 -f /tmp/ipfilt.exp
Directory /tmp/ipfilt.exp created.
Filter rule 2 for IPv4 has been exported successfully.
Filter rule 3 for IPv4 has been exported successfully.
Filter rule 4 for IPv4 has been exported successfully.
Filter rule 5 for IPv4 has been exported successfully.
...
..
Filter rule 56 for IPv4 has been exported successfully.
Filter rule(s) have been exported to /tmp/ipfilt.exp/ipsec_fltr_rule.exp successfully.

2. flush all existing filter rules

    /usr/sbin/rmfilt -v4 -n all

3. import filter rule file from directory
   /usr/sbin/impfilt -f /root

4. list imported filter rules
   /usr/sbin/lsfilt -v 4 –O




1 permit 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 no udp eq 4001 eq 4001 both both no all
 packets 0 all 0 none  Default Rule
2 shun_host 0.0.0.0 0.0.0.0 192.168.1.105 255.255.255.255 yes all any 0 eq 69 bo
th inbound no all packets 0 all 300 none  AIXpert:IPv4:ShunHost192.168.1.10569
3 shun_host 0.0.0.0 0.0.0.0 192.168.1.105 255.255.255.255 yes all any 0 eq 67 bo
th inbound no all packets 0 all 300 none  AIXpert:IPv4:ShunHost192.168.1.10567
4 shun_host 0.0.0.0 0.0.0.0 192.168.1.105 255.255.255.255 yes all any 0 eq 43 bo
th inbound no all packets 0 all 300 none  AIXpert:IPv4:ShunHost192.168.1.10543
5 shun_host 0.0.0.0 0.0.0.0 192.168.1.105 255.255.255.255 yes all any 0 eq 25 bo
th inbound no all packets 0 all 300 none  AIXpert:IPv4:ShunHost192.168.1.10525
6 shun_host 0.0.0.0 0.0.0.0 192.168.1.105 255.255.255.255 yes all any 0 eq 19 bo
th inbound no all packets 0 all 300 none  AIXpert:IPv4:ShunHost192.168.1.10519
7 shun_host 0.0.0.0 0.0.0.0 192.168.1.105 255.255.255.255 yes all any 0 eq 13 bo
th inbound no all packets 0 all 300 none  AIXpert:IPv4:ShunHost192.168.1.10513
8 shun_host 0.0.0.0 0.0.0.0 192.168.1.105 255.255.255.255 yes all any 0 eq 11 bo
th inbound no all packets 0 all 300 none  AIXpert:IPv4:ShunHost192.168.1.10511
9 shun_port 0.0.0.0 0.0.0.0 192.168.1.105 255.255.255.255 yes udp any 0 eq 666 b
oth inbound no all packets 0 all 300 none  AIXpert:IPv4:ShunPort192.168.1.105666

10 shun_port 0.0.0.0 0.0.0.0 192.168.1.105 255.255.255.255 yes udp any 0 eq 635
both inbound no all packets 0 all 300 none  AIXpert:IPv4:ShunPort192.168.1.10563
5
11 shun_port 0.0.0.0 0.0.0.0 192.168.1.105 255.255.255.255 yes udp any 0 eq 547
both inbound no all packets 0 all 300 none  AIXpert:IPv4:ShunPort192.168.1.10554
7
12 shun_port 0.0.0.0 0.0.0.0 192.168.1.105 255.255.255.255 yes udp any 0 eq 546
both inbound no all packets 0 all 300 none  AIXpert:IPv4:ShunPort192.168.1.10554
6
13 shun_port 0.0.0.0 0.0.0.0 192.168.1.105 255.255.255.255 yes udp any 0 eq 194
both inbound no all packets 0 all 300 none  AIXpert:IPv4:ShunPort192.168.1.10519
4
14 shun_port 0.0.0.0 0.0.0.0 192.168.1.105 255.255.255.255 yes udp any 0 eq 162
both inbound no all packets 0 all 300 none  AIXpert:IPv4:ShunPort192.168.1.10516
2
5. Activate the new rules
   /usr/sbin/mkfilt -v4 -u -g start

You can also configure ipfilt from smit as follows:

smitty tcpip

                                     TCP/IP

Move cursor to desired item and press Enter.

  Minimum Configuration & Startup
  Further Configuration
  Use DHCP for TCPIP Configuration & Startup
  IPV6 Configuration
  Quality of Service Configuration & Startup
  Configure IP Security (IPv4)
  Configure IP Security (IPv6)

Configure IP Security (IPv4):




                          Configure IP Security (IPv4)

Move cursor to desired item and press Enter.

  Start/Stop IP Security
  Basic IP Security Configuration
  Advanced IP Security Configuration

Advanced IP Security Configuration:

                       Advanced IP Security Configuration

Move cursor to desired item and press Enter.

  Configure IP Security Filter Rules
  List Active IP Security Filter Rules
  Activate/Update/Deactivate IP Security Filter Rule
  List Encryption Modules
  Start/Stop IP Security Filter Rule Log
  Start/Stop IP Security Tracing
  Backup IKE Database
  Restore IKE Database
  Initialize IKE Database
  View IKE XML DTD
Configure IP Security Filter Rules




                       Configure IP Security Filter Rules

Move cursor to desired item and press Enter.

  List IP Security Filter Rules
  Add an IP Security Filter Rule
  Change IP Security Filter Rules
  Move IP Security Filter Rules
  Export IP Security Filter Rules
  Import IP Security Filter Rules
  Delete IP Security Filter Rules

The import thing to remember is that if you activate the rules and you make a mistake you will be immediately locked-out of your system, so ensure you have a console session open.

An interesting article about MPIO performance

MPIO (Multi-path IO) has always been an interesting and complex subject. This article has some interesting suggestions:

https://www.ibm.com/developerworks/aix/library/au-aix-mpio/

PCI-DSS 3.1

The latest version of PCI-DSS (3.1) has recently released http://searchsecurity.techtarget.com/news/4500244448/PCI-DSS-31-debuts-requires-detailed-new-SSL-security-management-plan and this includes much tighter rules on the use of certificates and encryption algorithms.

Locking-down smit

It is possible to restrict a user's access to smit (menus) and to escape to the shell from a smit session:

If you run:

$ export SMIT_SHELL=n

for a user when they press F9 they will see the following error message:

  +--------------------------------------------------------------------------+
  |                           INFORMATION MESSAGE                            |
  |                                                                          |
  | Press Enter or Cancel to return to the                                   |
  | application.                                                             |
  |                                                                          |
  |   The Shell function is not available for this                           |
  |   session.                                                               |
  |                                                                          |
  | F1=Help                 F2=Refresh              F3=Cancel                |
F1| F8=Image                F10=Exit                Enter=Do                 |
F9+--------------------------------------------------------------------------+
Menu access can also be restricted by editing "/etc/security/smitacl.user" and adding a stanza for a user e.g.

$ cat /etc/security/smitacl.user
default:
        screens    =    *
        funcmode   =    roles+acl
backup:
        screens    =    shutdown,mksysb
        funcmode   =    roles+acl

NTP attacks

There are a lot of NTP reflection attacks currently being launched, it is therefore vital that you check if you version of NTP is vulnerable.

Run xnpdc as root:

# xntpdc
xntpdc> host <Your server name>
current host set to XXXX
xntpdc> monlist
***Server reports data not found

xntpdc> listpeers
client    ntp1.XXX
client    ntp0.XXX
broadcast 172.27.1.127

The monlist command should not return any results. You can also launch it directly from the command-line as follows:

# xntpdc -c monlist <IP_Address>

If you have any questions about the configuration of the "/etc/ntp.conf" file you can consult the sample files provided as standard by AIX in the "/usr/samples/xntp" directory:

/usr/samples/xntp/default.conf
/usr/samples/xntp/example.keys
/usr/samples/xntp/localclock.conf
/usr/samples/xntp/ntp.copyrights

If you are using AIX 7.1 you should already have NTPv4 installed, otherwise if you are running AIX 6.1 TL6 (or later) you can download the packages from the "AIX Web Download Pack Programs" site.

NTP4 Install images v7.1.0.3 for AIX 7.1
 ntp4-7.1.0.3.tar   (1.45 MB)
 
README-7.1.0.3
 README-7.1.0.3.txt   (317 B)
 
NTP4 Install images v6.1.6.3 for AIX 6.1
 ntp4-6.1.6.3.tar   (1.45 MB)
 
README-6.1.6.3
 README-6.1.6.3.txt   (317 B)

It is a good idea to install this version because even the standard version of NTPv4 on AIX 7.1 is affected by following vulnerabilities:

CVE-2014-9293: Weak default key
CVE-2014-9294: non-cryptographic random number generator with weak    seed used by ntp-keygen to generate symmetric keys
CVE-2014-9295: Buffer overflow
NTP4-6.1.6.3 for AIX 6.1 contains the fix for the above vulnerabilities.

To restrict the hosts that NTP will respond to edit the "/etc/ntp.conf" file:

restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap nopeer
or
restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

https://support.ntp.org/bin/view/Support/AccessRestrictions
http://www-01.ibm.com/support/knowledgecenter/ssw_aix_61/com.ibm.aix.files/ntp.htm

You can also further harden your NTP daemon by installing keys:

# /usr/sbin/ntpkeygen4

To use the authentication key file /etc/ntp.new.keys when restart the xntpd daemon, as follows:

# /usr/sbin/xntpd -k /etc/ntp.new.keys

The keys are stored in "/etc/ntp.keys" and the daemon will ignore requests from anyone who does not use this key.
If you are using NTPv3 the xntpd executable does not exist.

You can check or switch between NTP versions by manipulating the symbolic-links:

$ ls -ld /usr/sbin/ntp*
drwxr-xr-x    2 root     system          256 Dec 15 18:06 /usr/sbin/ntp3
lrwxrwxrwx    1 root     system           22 Dec 15 18:06 /usr/sbin/ntpdate -> /usr/sbin/ntp3/ntpdate
lrwxrwxrwx    1 root     system           19 Dec 15 18:06 /usr/sbin/ntpq -> /usr/sbin/ntp3/ntpq
lrwxrwxrwx    1 root     system           23 Dec 15 18:06 /usr/sbin/ntptrace -> /usr/sbin/ntp3/ntptrace

Cimserver

Cimserver

The cimserver service is installed as standard with AIX6.1 and the service is started from the “/etc/inittab”:

$ grep cim /etc/inittab

cimservices:2:once:/usr/bin/startsrc -s cimsys >/dev/null 2>&1

This service can be disabled if Director is not installed.

When first installed the cimserver is configured with a test certificate and this can be a problem for your corporate security policy. To view the test certificate:

 

$ cd /opt/freeware/cimom/pegasus/etc

$ openssl x509 -noout -in ./cert.pem -subject -dates -hash -fingerprint

subject= /C=UK/ST=Berkshire/L=Reading/O=The Open Group/OU=The OpenPegasus Project/CN=PEGASUS TEST CERTIFICATE-DO NOT USE

notBefore=Aug 27 09:09:25 2014 GMT

notAfter=Aug 24 09:09:25 2024 GMT

0e7a49a9

SHA1 Fingerprint=8C:95:90:02:73:E4:9A:06:26:77:16:F2:98:28:EA:77:B1:94:72:DB

 

To generate and install a new certificate follow these instructions:

http://www-01.ibm.com/support/knowledgecenter/ssw_aix_53/com.ibm.aix.cim/doc/cim/cimsecure.htm%23cimsecure?lang=en

 

The cimserver  listens by default on port 6988 however this can be changed in the following file:

 

$ cat /opt/freeware/cimom/pegasus/etc/cimlistener.conf

listenerPort="6988"

consumerDir="/usr/lib"

consumerConfigDir="../data/indication"

traceFilePath="/opt/freeware/cimom/pegasus/logs/cimlistener.trc"

#traceComponents="LISTENER"

#traceLevel="4"

The cimserver configuration file is: /opt/freeware/cimom/pegasus/etc/cimserver_current.conf however this file should not edited directly. To make changes use the cimconfig command. The default behaviour is to use SSL for communications, however this can also be disabled if required.