Bootstrap Protocol

[Nobody's Hero]

I am getting nailed by auditors for having "bootstrap protocal enabled on the system".

Recommendation: services that do not have a business need should be disabled by commenting out in /etc/inetd.con.

Can someone help me understand this.
What is the bootstrap, and why is it a risk to have it enabled? any inpact by disableing it?

Any recommendations appreciated.

[Patrick Wallek · Accepted solution]

The term they use is likely incorrect. I believe they are talking about bootp.

bootp can be used by some network devices to get an IP address. One way to check is to have a look at your /etc/bootptab and see if anything other than the default is defined. If not, then you should be able to disable without any problems.

To disable, comment the bootp line in /etc/inetd.conf and then run an 'inetd -c' to get inetd to re-read its configuration file.

[A. Clay Stephenson]

Man bootpd; it will explain the function. Whether or not this is bad or good will depend upon many factor. The primary purpose of bootp is to allow the booting of diskless workstations or Xterminals. I still have several of the old Entria II Xterminals (I like them because when combined with an LCD monitor, you have a very small footprint on your desk and they are silent) and these require bootp. You may have network printers which obtain their ip address, subnet, and gateway via bootp. If you have logging enables for inetd, you can see if you are actually receiving legitimate bootp requests; if not, then you can disable the service.

[A. Clay Stephenson]

Man bootpd; it will explain the function. Whether or not this is bad or good will depend upon many factors. The primary purpose of bootp is to allow the booting of diskless workstations or Xterminals. I still have several of the old Entria II Xterminals (I like them because when combined with an LCD monitor, you have a very small footprint on your desk and they are silent) and these require bootp. You may have network printers which obtain their ip address, subnet, and gateway via bootp. If you have logging enables for inetd, you can see if you are actually receiving legitimate bootp requests; if not, then you can disable the service.