topic Re: inetd.sec in Operating System - HP-UX

inetd.sec

Darrell Allen — Thu, 15 Nov 2001 14:38:59 GMT

Hi everyone,

I thought inetd.sec was only used to restrict access from remote systems to the local system's services. The man page doesn't indicate otherwise.

Has anyone actually used inetd.sec to disable connections being initiated from the local system?

I see how you could deny something like ftp from the local server to itself but that's still blocking it from the server side.

Thanks,
Darrell

Re: inetd.sec

harry d brown jr — Thu, 15 Nov 2001 14:42:47 GMT

inetd.sec is for incoming not outgoing requests!

To stop people from using something like ftp or telnet to another machine, simply change the permissions or "group it".

live free or die
harry

Re: inetd.sec

Uday_S_Ankolekar — Thu, 15 Nov 2001 14:44:47 GMT

Hi,

This file is to stop telnet ,ftp,rlogin etc from the other boxes. You can configure it to disable incomming requests.

-USA..

Re: inetd.sec

Craig Rants — Thu, 15 Nov 2001 14:47:20 GMT

If you want to totally block telnet or ftp services, comment out the service in the inetd.conf.

Then run inetd -c

Good Luck,
C

Re: inetd.sec

Roger Baptiste — Thu, 15 Nov 2001 15:00:10 GMT

<>

You are right. inetd.sec blocks incoming connections from external systems.

<>

oh yes, i just tried it ;-)
just add the line
telnet deny
It works. But it holds no meaning. Since, why would i need to stop telnetting into a system from that system iteslf?

when you do telnet , ftp ..
it tries to open a port of that service at the remote server. At the remote server, the inetd daemon services the request. Before the request is serviced, it checks whether it is authorised connection by looking the inetd.sec file.
If from systemA you do telnet to systemA , the local system will also be the remote server!

HTH
raj

Re: inetd.sec

James Beamish-White — Thu, 15 Nov 2001 15:04:27 GMT

Definitely only incoming.... from the man page:

"When inetd accepts a connection from a remote system..."

Other unix flavours need to use tcpwrappers to do the same thing, but HP is sooo good to us we don't need it ;-)

For outgoing (as noted in another thread in the forum), it's removal of access priveleges (chmod 500) that limit outgoing on a box, or firewalls if limiting at a network level.

Cheers,
James

Re: inetd.sec

Darrell Allen — Thu, 15 Nov 2001 15:20:53 GMT

Thanks everyone.

So far I've heard nothing different from what I thought: inted.sec is only for incoming connections (server side, that is).

Raj, in reference to disabling connections initiated from the local system, would you expand on what you mean when you say it works but it holds no meaning? I poorly worded the question before. To be specific, can inetd.sec be used to deny a user on the same box from initiating a connection as a client to another host? I think you're saying no which is what I believe to be true as well.

Darrell

Re: inetd.sec

Sanjay_6 — Thu, 15 Nov 2001 15:32:59 GMT

Hi Darrell,

As other have already said, inetd.sec is to restrict/prevent access to your system, not from your system.

Hope this helps.

Regds

Re: inetd.sec

Darrell Allen — Thu, 15 Nov 2001 16:21:47 GMT

Thanks for confirming my understanding of this issue.

Darrell