Примечания к выпуску для Cisco Cisco Broadband Access Center for Cable 4.1

Complying to these recommended hardening guidelines does not guarantee the elimination of all 
security threats. However, implementing these recommended guidelines will achieve a higher level of 
security and help manage unforeseen risks.

We recommend that you complete the following activities to harden your systems:

Ensure that all Sun Microsystems-recommended OS and Security patches have been applied. 
Contact Sun Microsystems Support to download the recommended patches and check for any 
applicable updates. 

Disable all unused network services. At a minimum, run the following Solaris command: 

# netservices limited

Use the latest version of the Solaris Security Toolkit to assist with system hardening. 

Disable unused daemons and services, especially services that use network resources; for example:

# svcadm disable svc:/network/smtp:sendmail

# svcadm disable svc:/network/finger:default

Uninstall all unused applications.

Apply the highest level of password protection to all network applications and services. Ensure that 
you change the default passwords.

Use HTTPS to access the Cisco BAC administrator user interface and disable the HTTP access. 
HTTP access to the administrator user interface (using port 8100) is enabled by default on the RDU. 
Currently, there is no way to disable the HTTP service using standard Cisco BAC administrative 
methods. You can, however, disable HTTP access using the Tomcat server.xml file, which is located 
at BPR_HOME/rdu/tomcat/conf. 

To do this:

Comment out the HTTP/8100 connector directive in the Tomcat server.xml file. For example:

<!-- <Connector port="8100" maxHttpHeaderSize="8192"

maxThreads="150" minSpareThreads="25" maxSpareThreads="75"

enableLookups="false" redirectPort="9453" acceptCount="100"

connectionTimeout="20000" disableUploadTimeout="true" /> -->

Reload the Tomcat process to make your changes take effect. For example:

# /etc/init.d/bprAgent restart tomcat

Process [tomcat] has been restarted.

If SNMP is not being used to manage the Cisco BAC components, then shut down the SNMP 
service. The SNMP service is enabled by default on the RDU and DPEs. This SNMP service uses 
UDP port 8001. You can disable this service for the RDU or a DPE using the snmpAgentCfgUtil.sh 
stop command from BPR_HOME/snmp/bin. For example:

# ./snmpAgentCfgUtil.sh stop

Process [snmpAgent] has stopped.

For information on the complete list of Cisco BAC bugs, see the BAC4101_BugList.html file in the /docs 
subdirectory of the Cisco BAC CD-ROM, or at the Cisco BAC software download site on 

.