topic Re: Ping,Telent in Operating System - HP-UX

Ping,Telent

David_492 — Mon, 27 Oct 2003 02:20:17 GMT

Dear aLL

could any body tell me how i can prevent anybody outside to ping or telnet to my servers?without using SSH.

my servers are HPUX-rp8400

Re: Ping,Telent

Thierry Poels_1 — Mon, 27 Oct 2003 02:25:05 GMT

Hi,

the most secure way is to block this on the firewall.

You can have a look at /var/adm/inetd.sec to block addresses/address ranges, but if somebody can logon to another server on your LAN, he might be able to ping/telnet from that server.

good luck,
Thierry.

Re: Ping,Telent

blal — Mon, 27 Oct 2003 11:01:17 GMT

Hi

You can do it in the inetd security file .

/var/adm/inetd.sec .

After doing the modification do inetd -c to force inetd demon to read the config file.

Re: Ping,Telent

Sanjay_6 — Mon, 27 Oct 2003 11:25:33 GMT

Hi,

to disable telnet, edit the /etc/inetd.conf file and comment out "#" the line starting with telnet.

telnet stream tcp nowait root /usr/lbin/telnetd telnetd

And then run inetd -c to force inetd to reread its configuration.

You cannot disable ping to your system. Also disabling telnet could be a risky move. So be carefule before you do something like that.

Hope this helps.

Regds

Re: Ping,Telent

Steven E. Protter — Mon, 27 Oct 2003 11:45:26 GMT

The ping part might requier ipfilter.
http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B9901AA

The telnet as noted can be done by disabling telnet or the inetd.sec change noted above.

If I'm wrong about the ping part, I'd like to see an inetd.sec example that shows how to disable ping(if this were my question that would be the prerequisite for earning a bunny).

SEP

Re: Ping,Telent

Ron Kinner — Mon, 27 Oct 2003 16:04:02 GMT

You can partly turn off pings with:

ndd -set /dev/ip ip_respond_to_echo_broadcast 0

This will keep it from responding to broadcasts (a.b.c.255) but it will still want to respond to a direct request.

http://www.cromwell-intl.com/security/security-stack-hardening.html

also recommends:

ndd -set /dev/ip ip_forward_directed_broadcasts 0

ndd -set /dev/ip ip_respond_to_address_mask_broadcast 0

ndd -set /dev/ip ip_respond_to_timestamp_broadcast 0

ndd -set /dev/ip ip_respond_to_address_mask_broadcast 0

ndd -set /dev/ip ip_respond_to_timestamp_broadcast 0

Ron

Re: Ping,Telent

David_492 — Tue, 28 Oct 2003 07:40:15 GMT

I tried to use the command

ndd -set/dev/ip ip_respond_to_echo_broadcast 0

and i use other commands but always i got module ' ndd.......' invalid argument any body has an idea inorder to disable ping.

Re: Ping,Telent

Ron Kinner — Tue, 28 Oct 2003 09:43:31 GMT

Not sure why it doesn't show but there is a space between -set and /dev... on all of the commands.

Ron

Re: Ping,Telent

Brian Lee_4 — Tue, 28 Oct 2003 11:11:56 GMT

You can not set up blocking "ping" in a server but do it in firewall.
However, you can set which IP address can or cannot telnet in to the server in /var/adm/inetd.sec file.
After you finish configuring the file, run "inetd -c" to refresh network setting.