Our management has raised that the current naming convention
of our servers would reveal the organisation name and OS type
& this subject us to security risks (eg: boasun1 where boa is
our company name & sun is our OS/platform type).
a)firstly, is this truly a security threat among IT security circle
& if so, is this a high or low risk? If not, kindly refer me to
some websites or security sources that refutes it.
My view is : most of our users are public users who
browsed our urls (so I don't think the hostnames are
exposed on the IE browsers). Genuine hackers would
use tools to find out the OS platform (so hardening helps?)
& I believe there are places out there (NIC?) that given
an address, we can find out which organization (or was
it ISP) owned that domain name/public Internet address.
A couple of 3rd parties ftp to us using point to point link,
so as long as in our ftp banner, we don't reveal our
organization name, that's good in itself.
Out-sourced developers who accessed our system will
know anyway as they login using telnet.
b)What's the general acceptable secure naming convention
people adopts out there & what's the maximum length for
hostname (across different Solaris versions; HPUX, Linux
as well if you know). Would you use small or capital letters
& a certain character(s) depicting the application/purpose
& the OS/platform type? Or part of the hostname contains
name of fruits/animals has any merits in it - one person
suggested this?
c) Is hardening of OS (eg, ssh/telnet/ftp login banner)
sufficient so that we can leave the hostname alone?
d)what are the tools hackers use to find out the OS type
of servers & how do we circumvent these? I guess
internal users who are inside our internal local LAN
are probably difficult to guard against as they can
scan for actual IP addresses of the servers while the
public users are accessing the "NAT'ed" (address
translated addresses ie they don't know the actual
private address of the servers). Internal users usually
access the servers via Oracle clients or applications
for data entry (telnet/ssh/ftp limited to outsourced
developers & IT support)
e)What's the system/network impact?
- Change the server's name in DNS
- hostname (hosts, hostname.interface, nodename in /etc)
- oracle databases (tnsnames.ora, listener.ora or anything
from DBA point of view? Sql scripts is not under my care)
- CA Unicenter monitoring agent on each monitored server
needs to be reinstalled?
- HP DataProtector backup (previously omniback) agent
needs to be reinstalled?
- will any OS patches (for Solaris, HPUX, Redhat, Windows)
need to be reinstalled?
Appreciate if detailed steps to take for each of the OS platform
(Solaris, HP-UX, RedHat, Windows & Oracle) is given, ie which file in
which directory to change (eg for Solaris, change hosts, nodename
& hostname.interface files in /etc directory).
Kindly address as many of the points raised where possible.
Thanks a lot.
Start Free Trial
