best practices uses of inetd.sec

[Gale Austin-Moore]

We would like to implement inetd.sec within our organization. I'm not seeing much in the way of "best practice" and/or standards for the use of this file. I'd like to use the information as a baseline for our organization. Can anyone out there help? Exmaples, etc. would be great

[Ken Hubnik_2]

We use it to limit the use of services (ftp etc) for only those ip addresses. You basically use this to secure the services to a range of IP addresses.

[Shannon Petry]

I dont think you will find a best practices anywhere. What you need to do is look at the man page for inetd.sec, and restrict the services you want restrictions on. The man page gives you the basic inetd services, which you can get from /etc/inetd.conf, as well as information on how to restrict access to these services.

Not all sites will run the same services, so it would be very difficult to give a best practices for it.

NOTE: You should disable unused services on any UNIX system. I.E. mountd on non NFS servers, ftpd on non ftp servers, etc... This will limit how much editing of inetd.sec you have to do, and have greater impact on security than inetd.sec.

Regards,
Shannon

[Sridhar Bhaskarla]

Hi,

The thumb rule is "deny" everything and "allow" only what you want. For ex., to restrict ftp to only few hosts, add the following to your inetd.sec

ftp deny
ftp allow host1, host2

You can enable wild characters. For syntax look at inetd.sec man page.

-Sri

[F. X. de Montgolfier]

If you're using inetd.sec, it means you're interested in security...
the following link is one which I found very useful in setting up "manually" a relatively secured server:

http://people.hp.se/stevesk/bastion11.html

gives step-by-step instructions. It's IMO rather nice and give a good view of the paranoid mindset you need to have when dealing with security ;-)

Cheers,

FiX

[Gale Austin-Moore]

Thank you for the replies..

[Steven E. Protter]

We use it to limit the hosts we will accept various kinds of protocols from.

since we still run a telnet legacy app, we have to allow telnet from virtually our entire network.

I actually authorize ftp users by ip address because I don't want anyone but development using this protocol and shipping clear text passwords across the network.

I'll give you an example from a non production machine.

If you need it I can provide you a blow by blow.

[Gale Austin-Moore]

Steven,
Thank you for your offer. I believe I have a pretty good file for what the entries should look like.