Safe and Powerful: Security in HP-UX System

Management Homepage (SMH)

A white paper on the security related features in the web-based SMH
Revision 1.0

EXECUTIVE SUMMARY
This white paper provides an overview of the security aspects in HP SMH, which is
the single system management solution introduced to manage an HP-UX system. The
white paper describes the various security features that the application provides, and
includes security related tips for system administrators.
The intended audience for this document includes HP customers currently using or
planning to use the HP System Management Homepage application, system
administrators, response center engineers and HP field and consulting personnel who
advise customers on solutions for their environments. It is assumed that the reader has
functional knowledge of HP-UX system administration.

Table of Contents
Introduction ......................................................................................................................................... 3
SMH key benefits................................................................................................................................. 3
SMH creating a secure product .......................................................................................................... 4
SMH security features ........................................................................................................................... 4
Managing SMH security ....................................................................................................................... 5
The Security menu ............................................................................................................................ 5
Kerberos authentication .................................................................................................................... 7
Timeout Values ................................................................................................................................ 7
Startup Modes ................................................................................................................................. 8
Key and certificate information .......................................................................................................... 9
Secure custom menus........................................................................................................................ 9
Logging .......................................................................................................................................... 9
Bastille (IPFilter) and its affect on SMH Partition Manager ................................................................... 10
Securely maintaining SMH Tips ........................................................................................................ 11
SMH documentation .......................................................................................................................... 11
For more information .......................................................................................................................... 13
HP SIM Security Resources .............................................................................................................. 13
Apache Security Resources .............................................................................................................. 13
Call to action .................................................................................................................................... 13

Introduction
HP System Management Homepage (SMH) is the single system management solution for
managing HP-UX 11i. It is a web-based tool and uses the Apache web server. SMH is also
available for Linux, and Microsoft Windows systems.
The key features of SMH are its system administration capabilities and its ability to display
details of hardware attributes. The SMH solution provides an easy-to-use interface for
displaying hardware fault and status monitoring, system thresholds, diagnostics, and software
version control for an individual server by aggregating the data from HP web-based agents
and management utilities.
SMH integrates with HP Systems Insight Manager (HP SIM) the strategic platform for
multisystem management from HP. HP SIM provides multisystem management capability by
providing administrators single sign-on (SSO) access to SMH on managed servers (standalone or partitioned) from a central console.
Security is a prime goal in the development of SMH. A number of security features are built
into SMH, and the system administrators too can take steps to ensure that security is
maintained during the implementation, usage, and maintenance of SMH. This paper
describes the SMH security features and, contains information and references related to the
security of SMH.

SMH key benefits

SMH offers the following benefits:

SMH provides a common cross-platform single-system management solution for HP-UX

11i, Windows, and Linux.

SMH is bundled with HP-UX 11i v3 Base Operating Environment, as well as the
Foundation Operating Environment on HP-UX 11i v1, v2, and earlier versions of v3. The
user does not need to make any configuration changes to start using the application.

SMH uses operating system-based Secure Sockets Layer (SSL) and host-based
authentication to protect web-based system management tools. The tool provides a
secure, encrypted connection between the web browser and the host system.

SMH uses open standards such as WBEM-based property pages for operating system,
software, and hardware information.

SMH is tightly integrated with HP SIM. This offers several advantages:

Gives users the ability to manage multiple systems from a single console, HP
SIM.

Enables users to determine which aspects of their HP-UX system and software
might require corrective action.

Enables users to view entities requiring attention, and drill down to subsequent
levels of detail until the precise situation and corrective action is determined.

Eliminates tool roulette by providing a guided path to the tool from which
appropriate action can be taken.

SMH provides system management capabilities through plug-in applications. The user
can add custom system management applications in to SMH.

SMH offers auto-start and time-out features that the user can configure by using the
hpsmh(1M) and smhstartconfig(1M) commands.

SMH supports the Mozilla, Firefox, and Internet Explorer web browsers.

SMH provides the command preview feature that enables the user to view the commands
that will be run for a task before executing that task. This feature facilitates training and
usage in scripts.

A majority of the SMH applications are localized. Online help for some of the
applications are available in nine languages: English, French, German, Italian,
Japanese, Korean, Simplified Chinese, Spanish, and Traditional Chinese.

All the key administrative actions are recorded in samlog, which can be viewed through
the Samlog Viewer in SMH.

SMH creating a secure product

HP takes the security of its products very seriously and wants to protect customers against
vulnerabilities. The following security related items have been included in the development of
SMH to ensure security:

SMH undergoes a periodic security analysis known as CATA (Commercial Application

Threat Analysis). The various management utilities that plug-in to SMH also undergo this
analysis. Anything found during this analysis that is of concern is added back into the
next development/release cycle of the product. If it is an urgent item, a patch is
developed and released.

SMH uses the secure http protocol (https).

SMH validates user inputs. SMH has a limited number of user input fields and the fields
that are available are validated. This reduces the chances of SQL Injection, or other
scripting techniques being used against the SMH product.

SMH takes care of cross-site scripting vulnerabilities.

The Apache instance for SMH runs as a non-privileged user (hpsmh). In addition, SMH
runs its own Apache instance, with its own built-in security controls, separate from any
other Apache instance that may be running on a system.

The SMH development team follows industry standard Apache security best practices as
part of the SMH configuration (see the For more information section at the end of this
paper for links to Apache Security resources).

The SMH team works closely with the HP team that builds and supports Apache for
HP-UX. Any vulnerability that is announced in Apache in the industry is mitigated in the
HP-UX version of Apache.

A team within HP, known as the Software Security Response Team (SSRT), is dedicated to
addressing any and all potential security vulnerabilities with software and firmware
products sold and supported by the Hewlett-Packard Company. SMH team works closely
with the SSRT team to fix any reported vulnerabilities.

SMH security features

SMH provides the following enhanced security and streamlined operations:

Browser access using operating system-based SSL-secure authentication.

Common HTTP and HTTPS service for HP Insight Management Agents and utilities, for
reduced complexity and system resource requirements.

Certificate-based authentication which is considered to be a very safe and secure mode

of authentication. Certificates signed by CAs such as VeriSign can be used for this.

Simplified architecture for implementing HTTP security and HP management updates.

Greater access control through NIC binding and advanced configuration features for
individual and groups of users.

Broader operating system and browser support.

Facility to launch X application and Run a command. It is available in SMH -> Tasks ->
Launch X Application -> Launch X Application as Root -> Run Command -> Run
Command as Root.

Managing SMH security

The Security menu
The Security link in SMH provides options for you to manage the security of SMH itself. For
more information about configuring all of these powerful security settings, refer the System
Management Homepage User Guide. The security options in SMH are as follows:

IP Binding
Settings System Management Homepage Security IP Binding
IP Binding specifies the IP addresses that SMH accepts requests from and controls the nets
and subnets that requests are processed.
Administrators can configure SMH to bind only to addresses specified in the IP Binding
window. You can define up to five subnet IP addresses and netmasks.
An IP address on the server is bound if it matches one of the entered IP Binding addresses
after the mask is applied.

IP Restricted Login
Settings System Management Homepage Security IP Restricted Login
IP Restricted login enables SMH to restrict login access based on the IP address of a system
from which the sign-in is attempted.

Local Server Certificate

Settings System Management Homepage Security Local Server Certificate
The Local Server Certificate link enables you to use certificates that are not generated by HP.

Multihomed Certificate
Settings System Management Homepage Security Local Server Certificate
SMH allows the setting of multihomed or multiple names to certificates that are not generated
by HP. Through this functionality, the certificate for SMH can contain additional information
for the machine, such as other names in the network and IPs that are available. In the same
way, it is possible to create a request certified to be signed by a Certificate Authority (CA).
Two kinds of values are acceptable as alternative names:

DNS name (for example, Linux;Linux.localdomain)

IP Address (for example, 10.16.165.1;192.168.1.189)

Anonymous/Local Access
Settings System Management Homepage Security Local/Anonymous Access
Anonymous/Local access enables you to select the following settings to include:

Anonymous Access (Disabled by default). Enabling Anonymous Access enables a user to

access the SMH without logging in. If Anonymous is selected, any user, local or remote,
has access to unsecured pages without being challenged for a username and password.
Caution: HP does not recommend the use of anonymous access.

Local Access (Disabled by default). Enabling Local Access means you can gain local
access to SMH without being challenged for authentication. This means that any user with
access to the local console is granted full access if Administrator is selected.
Caution: HP does not recommend the use of local access unless your management server
software enables it.

Trust Mode
Settings System Management Homepage Security Trust Mode
The Trust Mode link provides options that enable you to select the security required by your
system. Some situations require a higher level of security than others. Therefore, you have the
following security options:

Trust by certificate

Trust by name

Trust all

Trusted Management Servers

Settings System Management Homepage Security Trusted Management
Servers
Certificates establish the trust relationship between HP SIM or Insight Manager 7 and SMH.
The Trusted Management Servers link enables you to manage your certificates in the Trusted
Certificates List. Note the following:

Trust by certificate

Trust by name

Trust all

User Groups
SMH uses operating system accounts for authentication and enables you to manage the level
of access of operating system accounts at an operating system account group level.
The users in the operating system group Administrators for Windows or the operating system
group root (which in turn contains the user root by default) for HP-UX and Linux, can define
operating system groups that correspond to SMH access levels of Administrator, Operator, or

User. After operating system groups are added, the operating system administrator can add
operating system users into these operating system groups.

Each SMH access level can be assigned up to five operating system groups. The SMH
installation enables you to assign the operating system groups to SMH. SMH will not allow
adding an operating system group if the specified operating system group is not defined in
the operating system.
The accounts used for SMH need not have elevated access on the host operating system. Any
SMH user with administrative privilege can specify operating system user groups to each
access level of SMH. As a result, all accounts in each operating system user group have
access to SMH specified in the User Groups window.

Kerberos authentication
Administrative access to SMH can be controlled by setting up an SMH User Group, which in
turn maps to a UNIX Group. The UNIX Group can be a group local to the HP-UX system or
can be a group that is maintained in a Directory Service such as Active Directory (as long as
Kerberos and LDAP-UX are installed and configured on the HP-UX system).
Once the Kerberos Authentication is configured, along with SMH User Group, users can
login to SMH as themselves and will have Administrative authority. There would be no reason
to login to SMH directly as root.
SMH uses the sysmgthp service. Since this service is not configured in pam.conf by default
the PAM engine will use the OTHER service, which does not have pam_krb5 configured. By
adding the following to pam.conf you can login to SMH as a user defined in Active
Directory, after configuring the users group in Settings -> System Management Homepage ->
Security -> User Groups.
sysmgthp

auth

required

libpam_hpsec.so.1

sysmgthp

auth

sufficient

libpam_krb5.so.1

sysmgthp

auth

required

libpam_unix.so.1 try_first_pass

sysmgthp

account required

sysmgthp

account sufficient libpam_krb5.so.1

sysmgthp

account required

libpam_hpsec.so.1

libpam_unix.so.1

Timeout variables
The SMH configuration is based on environment variables and tags that are set by the
/opt/hpsmh/lbin/envvars, /opt/hpsmh/conf.common/smhpd.xml and
/opt/hpsmh/conf/timeout.conf files. To change the default configuration, you can
modify the files to properly set the value of the variables and tag. Table 1: SMH
Configuration Timeout Variables describes the variables. These variables can also be set
through the GUI interface in SMH version A.3.0.0 and later.

Table 1: SMH Configuration Timeout Variables

Variable
JAVA_HOME

<sessiontimeout>15</sessiontimeout>

TIMEOUT_SMH

TIMEOUT_TOMCAT

Description
This variable points to the
/opt/hpsmh/lbin/envvars
directory where JDK is installed.
The <session-timeout> tag
defines the HP SMH session timeout in
minutes. If it is defined, then the HP
SMH session stops after the time
period has elapsed without any user
activity. If it is not defined, then the
default for the HP SMH session timeout
is 15 minutes. You can define the
<session-timeout> tag using any
value between 6 and 120 minutes.
The TIMEOUT_SMH environment
variable defines the HP SMH server
timeout in minutes. If it is defined and
lower than the HP SMH session
timeout, the HP SMH server stops 3
minutes after the HP SMH session
timeout. If it is defined and greater
than the HP SMH session timeout, then
the HP SMH server stops after the time
period has elapsed without any user
activity. If it is not defined or equal to
zero, then HP SMH starts without
timeout. When the automatic startup
on boot startup mode is in use, the
timeout mechanism does not start.
This variable defines the Tomcat
timeout in minutes in the
/opt/hpsmh/conf/timeout.conf
file. If it is defined, Tomcat stops after
this time period has elapsed without
any request to a Java web
application. By default, the timeout for
the HP-UX Tomcat-based Servlet
Engine is 20 minutes and the timeout
for the HP-UX Apache-based Web
Server is 30 minutes. If it is not
defined or equal to zero, then Tomcat
starts without timeout. In this case,
Tomcat stops only when HP SMH is
stopped.

Script
/opt/hpsmh/lbin/envvars

/opt/hpsmh/conf.common/smhpd.xml

/opt/hpsmh/conf/timeout.conf

/opt/hpsmh/conf/timeout.conf

Startup modes
SMH supports three startup modes. You can set the startup mode according to your security
policies and requirements.

Autostart URL
This mode is the default setting for startup. You can start SMH by using a web browser and
navigating to http://hostname:2301/. If autostart is configured as the default, there is a
daemon listening only on http://hostname:2301. There is no daemon listening on port 2381
and hence this port will fail. When a request reaches port 2301 (http), then the HP-UX
Apache-based Web Server is started on port 2381 (https) and the page is automatically
redirected.

Automatic startup on boot

This mode starts SMH automatically during system initialization. If the automatic startup on
boot mode is enabled and the system was rebooted using this configuration, you can access
SMH by using a web browser and navigating to https://hostname:2381/. The SMH Apache
server is listening on both http://hostname:2301/ and https://hostname:2381/. If you use
port 2301 (http), then it automatically gets redirected to port 2381 (https).
NOTE: For autostart URL and automatic startup on boot, you can use http://hostname:2301,
as it works in both cases. This is possible on an HP-UX system only.

Manual startup
You can start SMH from the HP-UX command line as long as you have an X-Windows
interface running (for example, if the DISPLAY variable is properly set). You can start SMH
using the smh command.
Use the /opt/hpsmh/bin/smhstartconfig script to configure the startup mode of the
SMH server and the Tomcat instance that SMH uses.

Key and certificate information

In HP-UX, both public and private keys for SMH are stored in the
/var/opt/hpsmh/sslshare directory. The files are called file.pem (private key) and
cert.pem (server certificate).
For detailed instructions on how to establish trust relationships using certificates, see the
System Management Homepage User Guide.

Secure custom menus

Only SMH users with Administrator authorization can create menus, and execute those menus
as the user root. For SMH users with Operator or User authorization, the custom menus that
they are allowed to access will be executed as the user who has logged in to SMH.
These custom menus are stored and managed in the
/opt/hpsmh/data/htdocs/xlaunch/custom_menus.js file which can be manually
copied from one system to other systems.

Logging
The System Management Homepage Log contains HP System Management Homepage
(SMH) level configuration changes as well as successful and failed login attempts. It is helpful
when troubleshooting login or access issues when logging in directly to SMH, or from the HP
Systems Insight Manager (HP SIM).
NOTE: You must have administrative access to SMH to access the System Management
Homepage Log. To access the System Management Homepage Log, select Logs System
Management Homepage System Management Homepage Log

The error log and access_log files are stored on the system at /opt/hpsmh/logs. The
System Management Homepage Error Log contains error information generated by SMH
modules and CGI execution errors (httpd). It is the first place to look when a problem occurs
with starting the server or with server operation because, the log often contains details of
what went wrong and how to fix the problem. The access_log records all requests processed
by the server. So all the URLs accessed will be logged in the access_log, which might be
helpful during auditing. Log records related to Tomcat are stored in a file catalina.out in
the directory /opt/hpsmh/tomcat/logs.

Bastille (IPFilter) and its affect on SMH Partition

Manager
Bastille is a system hardening program that enhances the security of an HP-UX host. It
configures daemons, system settings, and firewalls to be more secure. It can shut off services
and tools that are not required such as rcp(1) and rlogin(1), and can help to limit the
vulnerability of common internet services such as Web servers and DNS.
One of the facilities that Bastille uses to lock down a system is IP filtering. For information
about the requirements when using IP filtering with Partition Manager, see the Partition
Manager online help. If Bastille's interactive user interface is used, be aware of these issues
when answering the questions asked by Bastille.
Bastille also has three install-time security options that are represented by the following files in
/etc/opt/sec_mgmt/bastille:

HOST.config
This is a host-based lockdown, without IPFilter configuration. There is no impact on Partition
Manager when this configuration is used.

MANDMZ.config
This is a fairly tight lockdown, but allows select network ports that are used by common
management protocols and tools. For example, WBEM continues to function when this
configuration is used.
To open Partition Manager under this configuration, SSH must be used or changes must be
made to enable ports 2301 and 2381 (both ports are also required for SMH). You can
ensure that Partition Manager can be opened on a system where ports 2301 and 2381 have
been disabled. To do this, prior to running Bastille adjust the IP filtering by adding the
following entries to the /etc/opt/sec_mgmt/bastille/ipf.customrules file:
pass in quick proto tcp from any to any port = 2301 flags S/0xff keep state keep frags
pass in quick proto tcp from any to any port = 2381 flags S/0xff keep state keep frags
For more information, see the ipf(5) manpage.

DMZ.config
This is a tight lockdown. To open Partition Manager under this configuration SSH must be
used. Bastille also impacts using Partition Manager to remotely manage a system where
Bastille is enabled. After the normal transfer of certificates, Partition Manager will work as
described above if the HOST.config or MANDMZ.config configurations are used. However,
the DMZ.config configuration blocks WBEM traffic and thus prevents the usage of Partition
Manager for remotely managing the system.

10

For more information about Bastille, see the bastille(1M) manpage, and the Bastille User
Guide available at /opt/sec_mgmt_bastille/docs/user_guide.txt.

Securely maintaining SMH Tips

Here are some tips for maintaining a secure SMH environment:

Limit the number of root users.

Regularly review system and SMH logs.

Always logout of an SMH session. SMH automatically logs out the user if there is no
activity for the session timeout period, 15 minutes being the default period. It can be
changed to a value suitable for your security policy.

Closely monitor changes in critical SMH files (via HIDS or Tripwire).

Follow a good patch strategy. You can do the following:

Run SWA regularly or use your HP RSAA to provide patch analyses.

Perform reactive patching critical security issues.

Perform proactive patching every six months.

SMH (HP-UX) depends on system installed Apache, Tomcat, PHP and OpenSSL. If
there is any vulnerability reported for these products then you must upgrade the
Apache suite (hpuxwsAPACHE) installation.

Conduct periodic security audits.

Bastille Drift reports.

Nesssus and/or nmap scans.

HP WebInspect scans.

Report any vulnerabilities found back to HP.

Use the native web browser on a local system to invoke SMH (SSL will be used). Do not
set the X-Windows DISPLAY variable on the HP-UX system to create the display on your
local desktop the information, including password information will cross the network in
the clear. You must use the -F option to open the tools in an unsecure manner.

SMH documentation
For more information about SMH, see the following sources:
HP System Management Homepage Release Notes The release notes provide
documentation for what's new with the release, features and change notifications, system
requirements, and known issues. The release notes are available on the HP Technical
Documentation website at http://docs.hp.com.
HP System Management Homepage Help System The help system provides a set of
documentation for using, maintaining, and troubleshooting SMH. In SMH, go to the Help
menu.
HP System Management Homepage Installation Guide The installation guide
provides information about installing and getting started using SMH. It includes an
introduction to basic concepts, definitions, and functionality associated with SMH. The

11

installation guide is available on the HP Technical Documentation website at

http://docs.hp.com. Also, for Linux and Windows operating system releases, the installation
guide is available on the Management CD and at the SMH web page at
http://h18013.www1.hp.com/products/servers/management/agents/documentation.html
HP System Management Homepage User Guide The user guide provides a set of
documentation for using, maintaining, and troubleshooting SMH. For Linux and Windows
operating systems, this user guide is available under the SMH Help menu, and on the HP
Technical Documentation website at http://docs.hp.com. For HP-UX, HP no longer provides a
printed user guide. On HP-UX, see the SMH online help content for information on how to
use, maintain, and troubleshoot SMH.
Simplifying single-system management on HP-UX 11i HP System
Management Homepage (HP SMH) This white paper introduces SMH and the various
management plug-in applications that form part of SMH. The paper highlights the various
capabilities of SMH. The white paper is available on the HP Technical Documentation
website at http://www.docs.hp.com.
hpsmh (1m) manpage For HP-UX releases, the manpage is available from the command
line using the man hpsmh command. This information is not available for Linux and Windows
operating systems.
smhstartconfig (1M) manpage For HP-UX operating system releases, the manpage is
available from the CLI using the man smhstartconfig command. This information is not
available for Linux and Windows operating systems.
sam(1M) manpage For HP-UX operating system releases, the manpage is available from
the CLI using the man sam command. This information is not available for Linux and
Windows operating systems.
NOTE: The HP-UX System Administration Manager (SAM) is deprecated in HP-UX 11i v3.
The HP System Management Homepage Installation Guide documents the functionality
changes in SAM. The guide is available on the HP Technical Documentation website at
http://docs.hp.com
smh (1m) manpage This command is available in HP-UX 11i v3 (B.11.31) only. This is an
enhanced version of the sam(1m) command. For HP-UX operating system releases, the
manpage is available from the CLI using the man smh command. This information is not
available for Linux and Windows operating systems.
smhassist (1m) manpage You can use the smhassist command to verify the
configurations of SMH and see if there are any dependent software, patches or configuration
errors. For HP-UX 11i v3 (B.11.31) and HP-UX 11i v2 (B.11.23) operating system releases,
the manpage is available from the CLI using the man smhassist command. This
information is not available for HP-UX 11i v1 (B.11.11), Linux, and Windows operating
systems.
HP System Management Homepage website The website provides SMH information
and product links. Go to the HP website at http://www.hp.com or to the Software Depot
home at http://www.hp.com/go/softwaredepot and search for System Management
Homepage.
HP Insight Essentials software page This web page is at
http://www.hp.com/servers/manage

12

For more information

HP SIM security resources
Understanding SIM security
http://h10018.www1.hp.com/wwsolutions/misc/hpsim-helpfiles/hpsim_5_Security.pdf

Managing HP Servers through firewalls with SIM

http://h10018.www1.hp.com/wwsolutions/misc/hpsim-helpfiles/ManagingHPServerswithHPSIM.pdf

SIM Secure Data Transmission

http://docs.hp.com/en/5991-4498/ch01s08.html

Secure Shell in SIM 5.3

http://h10018.www1.hp.com/wwsolutions/misc/hpsim-helpfiles/hpsim_53_ssh.pdf

Apache security resources

Securing Apache Version 2.0
http://www.securityfocus.com/infocus/1786
20 Ways to Secure Your Apache Configuration:
http://www.petefreitag.com/item/505.cfm

Apache Security OReilly Book

http://www.apachesecurity.net/

10 Tips to Secure Apache:

http://techrepublic.com.com/2415-7343_11-159903.html

Call to action
HP-UX 11i v3 for HP Integrity and HP 9000 servers
www.hp.com/go/hpux11iv3

Copyright 2009 Hewlett-Packard Development Company, L.P. The information

contained herein is subject to change without notice. The only warranties for HP
products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed
as constituting an additional warranty. HP shall not be liable for technical or
editorial errors or omissions contained herein.
Linux is a U.S. registered trademark of Linus Torvalds. Microsoft and Windows
are U.S. registered trademarks of Microsoft Corporation. UNIX is a registered
trademark of The Open Group.
592202-001, September 2009

13