Disable some daemons on a secure HP-UX server

[kaushikbr]

Hi,

For security reasons we have to disable the following daemons or services on a HP-UX B11.23 IA server. What is the best way to do it ?
Thanks and regards
For all you suggestions.

Kaushik

Services/Daemons to be disabled :
bootps
tftp
ftpd
finger
shell
login
rusersd
walld
exec
talk
chargen
comsat
daytime
discard
rexd
sprayd
echo
rlogind
remshd

[network_4 · Accepted solution]

Rename the binaries of respective services

[VK2COT]

Hello,

There are couple of ways.

a) Use Bastille to automate it for you;

b) Edit /etc/inetd.conf and comment
out all of the protocols you listed above.

Then, restart the server or inetd itself...

c) Then, use some audit method to check
the server configuration.

If you trust me, you can use a Perl script
that runs over 200 tests (and now includes
support for HP-UX 11.31 as well):

http://www.circlingcycle.com.au/Unix-sources/HP-UX-check-OAT.pl.txt

It helps me a lot on many servers I work on
for customers every day :)

Of course, there are many other scripts around...

VK2COT

[Steven E. Protter]

Shalom,

>>
Rename the binaries of respective services
>>

No, this will cause errors and problems.

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6849AA

Requires:
http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=PERL

Note you can manualy disable many of these services in inetd.conf

SEP

[kaushikbr]

Hi,

Thank you all for your replies.

I was not aware of "bastille", this is a wonderful tool. I find it very useful for a novice administrator such as myself. However I was not sure ( before starting this thread )that disabling these daemons / services from the inetd.conf was the way to go forward. Thank you all for your very useful suggestions.


Regards
Kaushik