Disabling ftp and tftp access to a HP9000 Unix server

[Khalil Ahmed]

Hi, I would like to control FTPing into any of the Unix servers. I thought that if one disabled the ftp and tftp services in the /etc/services file (by hashing them out) this would prevent anyone from FTPing into the server. However, I have just tested this out and found that I could still use FTP Client and ftp to the Unix server from my PC (???).

We use ftp minimally so would rather keep ftp disabled and only enable when required, (rather than disabling it permanently and using SFTP).

Could someone please tell me how I can go about stopping FTPing into the Unix boxes?

Thanks

Khalil

[Tim Nelson]

the services file is only a port number to name lookup file.

need to modify /etc/inetd.conf ( then tell inetd to re-read config with inetd -c )

[A. Clay Stephenson]

Edit /etc/inetd.conf and comment the ftp entries. Then issue "inetd -c" to force a reconfiguration on inetd. Editing the services file does nothing -- that is only a name to port number mapping file.

To reenable the service(s), again edit the inetd.conf file and execute inetd -c.

[Mel Burslan]

comment out the entries in /etc/inetd.conf as well, as these are the directives telling your system what to do when an ftp request comes in.

[Pedro Cirne]

Hi,

You must also disable on /etc/inetd.conf

Then restart inetd daemon, by sending:

#kill -HUP

Enjoy :)

Pedro

[Raj D.]

Hi Khalil,

You can do the following:

1. # vi /etc/inetd.conf

2. put a # in the begining of the entry
"ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l -a -u000"

3. # /usr/sbin/inetd -c [ to re-read the entry in /etc/inetd.conf ]

This will disable ftp access , when required.

Cheers,

RajD.
----

[Biswajit Tripathy]

Khalil,
/etc/services file, as some else already
suggested, is only a name to port lookup
service. A service is NOT disabled if you
comment out a line in /etc/services.

While you could block ftp and tftp by modifying
inetd.conf file, as others have suggested, you
should consider using a desktop firewall (like
IPFilter), or better still, bastille (which,
among other things, also configures a desktop
firewall).

- Biswajit

[John E.Ophious]

Khalil,

/etc/inetd.conf. Check it out ok?

Peace on earth,

John E. Ophious

[Khalil Ahmed]

Thanks everyone for your replies.

Just one more thing... what's tftp used for?

I thought it was required for ignite?... however when I hashed out the line below from the inetd.conf file and ran "inetd -c" I found I could still do an ignite backup directly on the machine???

#tftp dgram udp wait root /usr/lbin/tftpd\
# tftpd /opt/ignite /var/opt/ignite

Regards

Khalil

[Florian Heigl (new acc)]

tftp(d) is used by ignite recoverys, not backups.

when You issue
boot lan

or anything like that, the installation kernel will be fetched via tftp from /opt/ignite/bin.

it means trivial file transfer protocol, and that's about it.
It's definitely not a very safe means of transfering data, but at least all it's weaknesses are known after many years of using it, and also it's small enough to fit in the system firmware.

you can disable it if You don't have to netinstall Your ignite clients (i.e. when using an ignite boot tape create by make_boot_tape) or if You have good documentation for recovery containing a 'reenable and testing of tftpd line'

:)