topic Re: Inetd Security in Operating System - HP-UX

Inetd Security

Matthew Whitaker — Mon, 06 Jun 2005 09:31:36 GMT

Can anyone point me to some good resources that detail what services are included in inetd.conf by default and what they do? My company is working to increase our security, and would like to ensure that any uneeded or potentially insecure services included in inetd.conf are stopped from running.

Re: Inetd Security

harry d brown jr — Mon, 06 Jun 2005 09:36:30 GMT

http://docs.hp.com/en/B2355-90685/ch02s04.html

basically search http://docs.hp.com

live free or die
harry d brown jr

Re: Inetd Security

harry d brown jr — Mon, 06 Jun 2005 09:37:58 GMT

http://www.blacksheepnetworks.com/security/resources/hp-ux11.html

live free or die
harry d brown jr

Re: Inetd Security

Simon Hargrave — Mon, 06 Jun 2005 09:38:13 GMT

If you are looking into security, i recommend you download and run the Bastille software.

This software will check various aspects of server security (including inetd) and give recommendations and details information about the services/issues it finds.

If you run it on one of your test boxes you can get a list of recommendations with details descriptions, which you can cut/paste into a report for your bosses ;)

Find it on http://software.hp.com

Re: Inetd Security

Doug Burton — Mon, 06 Jun 2005 14:08:22 GMT

Hope this helps: http://web.tampabay.rr.com/batcave/inetd_conf.htm

Re: Inetd Security

roger_122 — Thu, 09 Jun 2005 14:03:36 GMT

Matthew

Take a look at:

http://www.cisecurity.org/

There is a benchmark tool for HPUX ..

Regards

Roger

Re: Inetd Security

Jeff_Traigle — Thu, 09 Jun 2005 14:52:10 GMT

There's actually not much in the stock inetd.conf that should be running. FTP and telnet are insecure and should be disabled. tftp should be off unless it's an Ignite server or boot server for some device that requires the service. bootps should be off unless it's an Ignite server or general purpose Bootp/DHCP server. finger, r-services, uucp, ntalk, ident... all bad or useless and should be disabled. The rlpdaemon service not needed unless it's a print server. Inetd internal services, useless and should be disabled. rpc services are disabled by default, I believe. Kerberized r-services not needed most places and should be disabled.

Re: Inetd Security

MZ_1 — Thu, 09 Jun 2005 15:05:53 GMT

Here is a checklist from cert. I agree with jeff. you'll probably be left with telnet and ftp when your done editing. then you can look at secure shell.

http://www.cert.org/tech_tips/usc20_full.html

Re: Inetd Security

Alzhy — Thu, 09 Jun 2005 15:13:56 GMT

Matthew,

Best secure configuration for any UNIX system is to have NOTHING in /etc/inetd.conf. Your well-known INET services ftp, telnet, logind, etc.. should be replaced by Secure Shell.

All of our UNIX servers now have blank inetd.conf configs. We use Secure Shell to replace clear text protocols line telnet, ftp, rlogin, rexec.. etc.