Disabling X windows services

[Ian Foster_2]

In the course of locking down our servers we have been asked to ensure the x services are secure - including disabling the service altogether on systems where it is not really required.

What's the best way to actually disable the service completely ?

Already looked at /etc/services and /etc/inetd.conf.

[Robert-Jan Goossens_1]

Hi,

Are you referring to CDE ?

# dtconfig -d

Check the manual page.

Hope this helps,
Robert-Jan

[Steven E. Protter]

Block port 7000 on the firewall

vi /etc/rc.confg.d/xfs

change the first variable to 0, this stops the font server for starting.

/sbin/init.d/xfs stop

done

SEP

[Ian Foster_2]

I am reffering to anything which would use port 6000 for any xwindows type session eg. Reflections-X.

Does this just stop CDE or all x emulator type services ?

Also looks like this would take a reboot to implement ?

[TwoProc · Accepted solution]

Ian, I'd be careful on this...
While the dtlogin server IS something you can shut off; your HP server is probably not *really* an X server. Your client workstation (Reflection X) is the actual X server. And that's where your security lay...

You can check out the list of x-servers allowed in your xhosts file though (man xhosts).

But, what I'm getting at is if you start cutting much more stuff - then you'll not be able to run any programs from your HP which require/want an x-display server (your PC with ReflectionsX for example) to display on.

You won't be able to run Glance, SAM, xstm, swinstall (in gui mode), etc. But these things all run b/c there exists an Xserver on your desktop - not b/c there exists an Xserver on your HP server...

So, you can stop CDE, but are you sure you mean to stop all X type traffic going in and out of the box?

[Robert-Jan Goossens_1]

No for /usr/dt/bin/dtconfig you do not need a reboot. This is the easiest methode for disabling CDE. Check also next doc (in reverse order :-)

Document description: Setting up to run CDE and HP-UX applications with Reflection X.
Document id: KBRC00000052

http://www4.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000076457539

Hope this helps,
Robert-Jan

[Ian Foster_2]

I agree - that's exactly what they are asking us to do - stop ALL x-type traffic to/from the box. I think it's security gone mad and not suprisingly we have only been able to identify two systems we can do this on without breaking some kind of functionality that the client requires.

Somebody has suggested that this can simply be achieved by stopping the listening on netwrok port 6000 but I'm not convinced.

[TwoProc]

Ian, other than removing all x-windows programs from the box - I don't think so. Even if port 6000 is shut - I can use "ssh -X" to get a tunnel to push X windows traffic through, and you're security guy will tell that you're *supposed* to use ssh. OK, now you've gotta take ssh out! Using that I see that I'm connected to my server on port 33088 and that changes w/ every new ssh command...

You could run swremove and get rid of all of the X packages - that would do it for sure.

Wait a minute, I know how, unplug it from the LAN... :-)

[Ian Foster_2]

Thanks guys - I think we're going to settle for checking out xhosts. I think there are plenty of other areas we should be worrying about tightening down without resorting to hacking about at the OS unnecessarily this way.

[Ian Foster_2]

Make it secure without resorting to hacking at the functionality - I guess.