As part of the SERT initiative, a "MegaPatch" has been developed to install security patches on Sun Microsystems machines running SunOS 4.1.3. The purpose of this message is to announce the availability of The MegaPatch version 1.5, and to notify SERT constituents of the forthcoming version 1.6. Both of these versions are applicable only to SunOS 4.1.3. Development is under way on a MegaPatch for SunOS 4.1.2. This package is not yet available. If you have any questions regarding the MegaPatch, please send electronic mail to megapatch@sert.edu.au. MegaPatch version 1.5 ===================== Release Date: 19/03/1992 This MegaPatch has been developed to apply a number of security patches in a one time manner to SunOS. The MegaPatch is an un-productised version of Sun Microsystems's ConSePT and as such may have additional features/ enhancements/improvements which are not supported by Sun. The MegaPatch currently works for SunOS systems 4.1.3 only and will require approximately 5-10Mb of free disk space to install and execute. It is recommended that this be installed on a freshly installed version of SunOS, as it is then unlikely that trojan horse or other similarly modified programs will exist on your machine. The MegaPatch is supplied as a compressed tar archive - there is a script file supplied for easy installation. It is distributed on an "all care and no responsibility" basis - that is, every care has been taken in it's development, but no responsibility will be accepted for unexpected results. The MegaPatch has been used by several sites already. The MegaPatch is available by anonymous ftp from ftp.qut.edu.au, under the security directory. The MegaPatch currently includes these patches: 100103-10 files, 100173-10 NFS, 100296-04 NFS, 100305-10 lpr, 100372-02 C2 & tfs, 100377-05 sendmail, 100383-05 rdist, 100448-01 OW3, 100478-01 OW3, 100482-04 NIS, 100507-04 tmpfs, 100513-01 tty, 100564-05 C2 & NIS, 100567-04 network, 100630-01 login/su, 100633-01 ARM/ASET Additional localisation routines have been added to the MegaPatch to enhance site security. The local scripts are detailed below: local.aaa A script to fix some of the permissions after the installation of the MegaPatch. local.log_tcp A script to install the TCP/IP firewall program log_tcp version 4.3. This restricts TCP/IP access to telnet and ftp by changing /etc/inetd.conf and further restricts these connections to this hosts. To allow wider access edit the file /etc/hosts.allow to add hosts or domains in comma separated lists. local.rmrhosts This script removes all .rhosts files and /etc/hosts.equiv, this makes the use of rsh... a little more secure. local.rread This script processes the binary system executables and removes the read permission on these. This make it more difficult for users to pull apart programs with the strings command or for users to accidently copy large amounts of data or to copy a program such as telnet to a file such as vi in their directory to evade system accounting. local.tripwire This script installes a default installation of tripwire 1.02 in the directory /usr/local/etc, with the database of file signatures being stored in /usr/local/etc/databases. local.ttytab This script ensures that secure is set ONLY for the console in the /etc/ttytab file. This way root can only login on the console. local.xx-cops This script will install a minimal installation of COPS in /usr/local/etc and produce a report on the security of your system. The report will be placed in the directory /usr/local/etc/cops_104/`hostname`. local.zz-kernel This script will ask additional questions with regard to which options you wish added or deleted from the kernel. To ensure maximum security, answer y to all questions (but be aware that this may limit the use of some subsystems). Then the kernel will be re-configured and rebuilt, even if their is no pre-existing kernel configuration file. THE KERNEL MUST BE REBUILT EITHER BY THIS SCRIPT OR MANUALLY AS SOME OF THE PATCHES CONTAIN FILES WHICH WILL AFFECT THE OPERATION OF THE KERNEL. If sites have already installed some of the patches, then perform the following steps before running the MegaPatch. 1. Determine the previously installed patches which are contained in the MegaPatch. 2. Look in each of the relevant directories at the installpatch script. The first action of the script file is to check for a file which has been renamed to filename.pre-$PATCHNUMBER. 3. To stop a certain patch executing, touch a file of the corresponding name as detailed in step 2 above. (eg. to stop Patch 100372-02 being re-installed touch the following file touch /usr/etc/tfsd.pre-100372-02 ) The following changes are planned for release 1.6 ================================================= Due date for release: 30/03/1993 (although this is not cast in stone). 1. The following patches will be upgraded to the latest release: Previous version Current version Detail -------------------------------------------------------------- 100173-09 100173-10 NFS jumbo 100305-10 100305-11 lpr 100383-05 100383-06 rdist 100513-01 100513-02 tty jumbo 2. The following patches will be added according to advise from CIAC (Advisory number D-11 on March 19, 1993): Patch number Detail ---------------------------------------- 100224-06 /bin/mail jumbo patch 100623-03 UFS jumbo patch 100891-01 libc replacement 3. The size of MegaPatch 1.6 will increase substantially due to the libc patch. It is anticipated that the compressed patch will now be approximately 6Mb (compared to approximately 3Mb for version 1.5). The MegaPatch is a result of the SERT initiative. The development work has been a joint effort between QUT staff and Sun Microystems. A MegaPatch for SunOS 4.1.2 is currently under development, and announcements will be made at the appropriate time. If you have any questions regarding the MegaPatch, please send electronic mail to megapatch@sert.edu.au.