topic Re: Run inetd in debug mode in Operating System - HP-UX

Run inetd in debug mode

HPP — Mon, 19 Nov 2001 20:08:49 GMT

Hi,
I am not able to recall how to start the debug mode for inetd.
It should be something like
#kill -USR1

Can anbody explain the process in detail.
Hope i am asking the right question!!!!!

Thanks

Re: Run inetd in debug mode

James R. Ferguson — Mon, 19 Nov 2001 20:16:01 GMT

Hi:

I think you are thinking of the connection logging mode in which 'inetd' can run. See the man (1M) pages for 'inetd'.

You can toggle logging on and off with:

/usr/sbin/inetd -l

Regards!

...JRF...

Re: Run inetd in debug mode

Craig Rants — Mon, 19 Nov 2001 20:24:05 GMT

I have never heard of debug mode for inetd, which doesn't mean it doesn't exist. I didn't find anything about it in the man page either.

The process James is talking about can be configured at boot as well.

/etc/rc.config.d/netdaemons
Look for this line and make sure the "-l" is there
INETD_ARGS="-l"

Good Luck,
C

Re: Run inetd in debug mode

HPP — Mon, 19 Nov 2001 20:35:24 GMT

Hi,
Thanks!!!
What i am looking for is to capture all the incomming connections, like to track port scans, tcp connections or any suspecious network activity on server.

Thanks

Re: Run inetd in debug mode

Craig Rants — Mon, 19 Nov 2001 20:42:47 GMT

You need some software like that can do some Intrustion detection and packet filtering. I would recommend ISS Real Secure or Axent ITA for the IDS part, as far as IP Filtering, hp can't do that part yet. All your going to see with inetd logging is connections based on the services listed in inetd.conf.

Good Luck,
C