topic Re: Disabling RSH in Operating System - HP-UX

Disabling RSH

Tim O'Connell — Mon, 14 Jan 2008 16:10:04 GMT

Hi,

We recently had a security audit & one of the responses was "rsh service running. Comment out the 'rsh' line in /etc/inetd.conf". Now I've checked inetd.conf & there is no 'rsh' line. I don't think it's running but how do I check what services are running. Also need to disable SNMP so any help on that service would be appreciated. We're running HPux 11.11 on 9000/800/L1500-7x

Many thanks,

Tim

Re: Disabling RSH

Jeff_Traigle — Mon, 14 Jan 2008 16:26:13 GMT

The following three lines deal with the r-services:

login stream tcp nowait root /usr/lbin/rlogind rlogind
shell stream tcp nowait root /usr/lbin/remshd remshd
exec stream tcp nowait root /usr/lbin/rexecd rexecd

The "shell" line is specific to remsh. (rsh is restricted shell in HP-UX, but a typical auditor probably won't know or care about that.) The "login" line is specific to rlogin and the "exec" line is specific to rexec.

Re: Disabling RSH

Jeff_Traigle — Mon, 14 Jan 2008 16:32:00 GMT

Also, don't forget to run "inetd -c" after you comment those lines for the change to be effective immediately.

As for disabling SNMP, there are several files in /etc/rc.config.d for various subcomponents:

SnmpHpunix
SnmpMaster
SnmpMib2
SnmpTrpDst

Use the corresponding scripts in /sbin/init.d to stop the services and then change the values of the START variables in these files to 0.

Re: Disabling RSH

Roberto Arias — Mon, 14 Jan 2008 17:11:50 GMT

Hi Tim

Please look for file /etc/host.equiv or $HOME/.rhosts and remove. please see man page of rsh and rlogin
hth

Re: Disabling RSH

Tim O'Connell — Mon, 14 Jan 2008 17:22:42 GMT

Many thanks for the prompt replies. Points assigned.

Thanks,

Tim

Re: Disabling RSH

Tim O'Connell — Mon, 14 Jan 2008 17:24:26 GMT

Problem resolved