topic Re: disabling finger completely in Operating System - HP-UX

disabling finger completely

Barbara Flynn_1 — Thu, 02 Oct 2003 09:50:34 GMT

Hi

I am trying to disable finger on a 11.11 server, I have commented the entry from both the /etc/inetd.conf and services files, and rebooted the server but I can still run the finger command on the server!

Any ideas on how to stop this???

Thanks Barbara

Re: disabling finger completely

Pete Randall — Thu, 02 Oct 2003 09:52:32 GMT

mv /usr/bin/finger /usr/bin/usedtobefinger
- or -
rm /usr/bin/finger

Pete

Re: disabling finger completely

Patrick Wallek — Thu, 02 Oct 2003 09:53:48 GMT

Move the finger command to finger.old.

Commenting out the lines in /etc/inetd.conf and /etc/services prevents someone from using finger on another machine to query your machine.

# finger @machine_name

Would result in a 'connection refused' error which is really what you want.

Re: disabling finger completely

Francis_12 — Thu, 02 Oct 2003 09:55:19 GMT

Hello Barbara,

To disable finger from remote connections, comment out the entries
in /etc/services and /etc/inetd.conf, restart inetd with the -c option. Test
using; finger @hostname.domain

Note; You will still be able to use finger on the system local, this can be
disabled by removing the execute permissions on the executable.

Hope this helps, Bye.

Francis DERDEYN - HP-UX ASCE.

Re: disabling finger completely

Graham Cameron_1 — Thu, 02 Oct 2003 09:57:08 GMT

Barbara

What you did would prevent anyone from another machine running finger against your machine.
ie "finger @yourmc" will be disabled.

What Pete suggests will stop people running the "finger" command on your maching by renaming or removing the /usr/bin/finger command.

*BUT* - your really devious users may find that there is another copy of finger on /bin/finger - you should rename or remove that also.

BTW - what have you got against "finger" ???

Re: disabling finger completely

Barbara Flynn_1 — Thu, 02 Oct 2003 10:02:38 GMT

All

Thanks for the help, problem solved, I had assumed that blocking the ports etc would be enough to stop the process on the machine itself.

Graham, I am hardening a server for a DMZ and finger is a security baddie!

Cheers Barbara

Re: disabling finger completely

Chris Vail — Thu, 02 Oct 2003 10:03:46 GMT

Move or rename the finger command in /usr/bin. A niftier way to do this is to write a shell script, and refer to that shell script in /etc/inetd.conf.

Chris

Re: disabling finger completely

Bill Hassell — Thu, 02 Oct 2003 13:56:28 GMT

I would suggest getting a copy of Chris Wong's book HP-UX 11i Security. It covers the details quite well. I would also suggest getting a copy of Bastille for HP-UX (there is also a version for Linux too). Bastille will walk you through the services and ports but since it knows all the rules and metyhods, it will turn them off correctly. The nice part is that it walks you through the steps with detailed explanations.

Re: disabling finger completely

GK_5 — Thu, 02 Oct 2003 14:00:07 GMT

Remove finger from /etc/services, comment it in /etc/inetd.conf and run "# inetd -c"

-GK-

Re: disabling finger completely

Qchi321 — Tue, 06 Oct 2020 18:28:16 GMT

Where exactly do you type this in at?