topic Security Scan in Operating System - HP-UX

Security Scan

joe_91 — Wed, 04 Oct 2006 14:37:37 GMT

Ident Service (Potential Bot/Zombie) Detected

Check to see if the ident service was started legitimately. If not, or if not required, disable the ident service. Also, scan the host with an updated antivirus scanner for infection.

what does the Ident Service mean? Also there is no Virus in Unix right?

Thanks

Joe

Re: Security Scan

Ivan Krastev — Wed, 04 Oct 2006 14:58:44 GMT

I think this is output from some security scanner. Take a look at /etc/inetd.conf - maybe you have ident service running. If you don't need it simply comment that line (with #) and reload inetd (inetd -c).

regards,
ivan

Re: Security Scan

spex — Wed, 04 Oct 2006 15:07:08 GMT

Joe,

The ident protocol identifies the username of the current user to a (remote) process. It runs on 113/tcp by default. This is most likely a false positive.

To disable identd, comment out the appropriate line in /etc/inetd.conf and 'inetd -c'.

For more information on ident:
http://en.wikipedia.org/wiki/Ident

There are UNIX viruses, but their number is tiny compared to the Windows world.

PCS

Re: Security Scan

john D_3 — Wed, 04 Oct 2006 16:01:42 GMT

Hi,

Please comment the following line in /etc/inetd.conf file:

ident stream tcp wait bin /usr/lbin/identd identd

and run inetd -c

Thanks

Re: Security Scan

Bill Hassell — Wed, 04 Oct 2006 19:56:20 GMT

ident is one of the archaic Unix services that are almost never used but like finger and rwho, they provide too much information about your system. Just comment it out and inetd -c re-read the file. Other archaic services:

uucp ntalk time daytime echo discard chargen

Re: Security Scan

Robert Fritz — Thu, 05 Oct 2006 10:32:46 GMT

The only really popular thing I can think of that (currently) relies on it is ServiceGuard.