topic Re: inetd.conf in Operating System - HP-UX

inetd.conf

Mohammad Sanaullah — Thu, 10 Jan 2008 13:56:26 GMT

Dear Team
Can someone let me know the functionality of following terms present in internal services in inetd.conf file, as we have to disable them...

1. Chargen
2. Time
3. daytime
4. discard
5. echo

Another point is
What is ipforwarding and what it does..

Thanks in advance...Points later.
waiting for reply.

Re: inetd.conf

James R. Ferguson — Thu, 10 Jan 2008 14:13:58 GMT

Hi:

These can most certainly be disabled. For more information, see:

http://forums12.itrc.hp.com/service/forums/questionanswer.do?admit=109447627+1199974290395+28353475&threadId=188195

Regards!

...JRF...

Re: inetd.conf

Zeev Schultz — Thu, 10 Jan 2008 14:23:36 GMT

man inetd:

"The inetd daemon provides several "trivial" services internally by use of routines within itself. The services are echo, discard, chargen
(character generator), daytime (human readable time), and time (machine readable time in the form of the number of seconds since midnight, January 1, 1900). The inetd daemon provides both TCP- and UDP-based servers for each of these services. See inetd.conf(4) for
instructions on configuring internal servers."

Most of those are outdated. Ie, echo was a predecessor of ping. daytime can be replaced by ntp if needed, chargen gives you just a string of charactes.Discard is just like /dev/null over tcp-ip.

I'd disable them and see if applications can survive. No idea if OS needs them.

Re: inetd.conf

Tim Nelson — Thu, 10 Jan 2008 15:21:28 GMT

I have always disabled these. It deters any questions during audit review, i.e. what are these ? why are they enabled ?.

Re: inetd.conf

Robert Fritz — Fri, 11 Jan 2008 18:52:39 GMT

Note that Bastille can automate this and other lock-down steps:
http://www.hp.com/go/bastille

Re: inetd.conf

Bill Hassell — Sat, 12 Jan 2008 02:02:54 GMT

These 5 services are obsolete and should always be disabled. Any security scan of your network will point them out as needing to be disabled. Unfortunately, most flavors of Unix default to turning them on for no good reason except it's always been done that way. In today's environment, no network service should be enabled unless it is needed.

Re: inetd.conf

Mohammad Sanaullah — Sat, 12 Jan 2008 04:41:19 GMT

Thanks a lot for all active participation...other wise its not a good idea to enable these thing as Auditor can make a point on security compromise...better disable them...
Thanks
Mohammad Sanaullah