Internet Services desactivation !

[Ivan Azuara]

Hi !

I want to desactivate the next services on my HPUX server:

- smtp
- pop3
- printer
- telnet

I don??t need thats services running on my server . The connection to this server are using ssh. I had thought in comment the corresponding lines for each services in /etc/services file and in the /etc/inetd.conf file.

It??s that enough ?, or i need to consider other things.


Thank's in advance !

[Jeff Schussele · Accepted solution]

Hi Ivan,

OK

smtp => ist run /sbin/init.d/sendmail stop then edit /etc/rc.config.d/mailservs & set SENDMAIL_SERVER=0

pop3 => refer to your pop3 server/client manual

printer => in /etc/inetd.conf comment out the line that starts printer .....

telnet => same as printer except comment out line starting with telnet .....

for the last two you must also run
inetd -c
for the changes to take effect.

HTH,
Jeff

[Steven E. Protter]

In Linux, you can control pop3 through its inetd.conf which is called xinetd.conf, or through its extensions.

Not so in HP-UX. /etc/services is like a reservation system, it lets you know what the port is for but simply commenting something out there doesn't finish the job.

Since you're using ssh, I'm attaching a guide for exchanging public keys and enabling connections without passwords.

SEP

[Tyler Easterling]

This sounds like a good start to hardening your system. You might think about a hardening tool to automate the process. Bastille has been ported to HP-UX and it will walk you through the process of disabling unneeded services on your system. It's available on software depot for FREE.

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=B6849AA

[Ivan Azuara]

I'm trying to download the HPUX Bastille software of HP website, but there isn??t available.

Some body knows of other place where i can download this software.

I forgot to attach all the ports in my last message, there are:

- smtp
- pop3
- login
- shell
- printer

I finish the desactivation of the "telnet,smtp and printer" ports. Can i use the same recommendations for desactivate the : shell,login and pop3 ports ?


Thank's in advance !

[Bill Hassell]

Probably looking in the wrong place...start in:

http://software.hp.com

(this for a *lot* of different software products) and select the "internet and security solutions" line. About halfwat down the page (or use CTRL-f to search for "secure"), you'll see this link:

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=T1471AA

You probably want to comment out a number of other (virtually unused and archaic) service in inetd.conf:

uucp ntalk ident daytime time echo discard chargen

Then depending on what your system is doing, look at commenting out:

tftp bootps finger exec printer kshell klogin dtspc recserv

As mentioned, just comment them out (and leave them in the inetd.conf for future reference), use inetd -c to change the current system and then look at the end of syslog.log for confirmation that the services were stopped.

[Oleg Zieaev_1]

Hello.

Comment out corresponding lines in /etc/inetd.conf and force inetd to re-read config file, i.e. inetd -c.
Check for confirmation in syslog. This is enough. You can also use telnet from remote system to verify you have connection rejected message.
If your concern is security - run iss or knocker to check for remote/local system's open ports. Once you done, the related ports will not be reported as open on your system.

Hope this helps.
-0leg