Disabling RSH

[Tim O'Connell]

Hi,

We recently had a security audit & one of the responses was "rsh service running. Comment out the 'rsh' line in /etc/inetd.conf". Now I've checked inetd.conf & there is no 'rsh' line. I don't think it's running but how do I check what services are running. Also need to disable SNMP so any help on that service would be appreciated. We're running HPux 11.11 on 9000/800/L1500-7x

Many thanks,

Tim

[Jeff_Traigle · Accepted solution]

The following three lines deal with the r-services:

login stream tcp nowait root /usr/lbin/rlogind rlogind
shell stream tcp nowait root /usr/lbin/remshd remshd
exec stream tcp nowait root /usr/lbin/rexecd rexecd

The "shell" line is specific to remsh. (rsh is restricted shell in HP-UX, but a typical auditor probably won't know or care about that.) The "login" line is specific to rlogin and the "exec" line is specific to rexec.

[Jeff_Traigle]

Also, don't forget to run "inetd -c" after you comment those lines for the change to be effective immediately.

As for disabling SNMP, there are several files in /etc/rc.config.d for various subcomponents:

SnmpHpunix
SnmpMaster
SnmpMib2
SnmpTrpDst

Use the corresponding scripts in /sbin/init.d to stop the services and then change the values of the START variables in these files to 0.

[Roberto Arias]

Hi Tim

Please look for file /etc/host.equiv or $HOME/.rhosts and remove. please see man page of rsh and rlogin
hth

[Tim O'Connell]

Many thanks for the prompt replies. Points assigned.

Thanks,

Tim

[Tim O'Connell]

Problem resolved