/etc/issue file not being displayed.

[Peter Gillis]

Hi,
We have a number of hp ux system all 11.00. Only one of these systems actually displays the contents of the /etc/issue file immediately before the login prompt on unused terminals. I need to have all systems displaying the contents of this file to meet some new security requirements. Can anyone help me here? What do I need to check? permissions on the /etc/issue file are 444 bin:bin. on all systems.
thanks
Maria.

[T G Manikandan · Accepted solution]

Make sure you have the -b option in the inetd.conf file for the line telnetd

telnet stream tcp nowait root /usr/lbin/telnetd telnetd -b /etc/issue

re-read your inetd.conf file using

#/usr/sbin/inetd -c


Thanks

[T G Manikandan]

Also for rlogin

login stream tcp nowait root /usr/lbin/rlogind rlogind -B /etc/issue

[Michael Tully]

Hi Maria,

The contents should be minimal to say the least with this file. Displaying any type of warning message can alert a potential hacker to what type of system your is.

We only have the hostname within the file, and this would only mean something to us, being the type of hostnames we use.

Also, with security requirements, you might also look at minimising the amount of services allowed. By default these are a good start. (copy of /etc/inetd.conf) if you make changes to this file, make sure you issue this command.
# inetd -c

HTH
Michael

tftp dgram udp wait root /usr/lbin/tftpd tftpd /opt/ignite /var/opt/ignite
#bootps dgram udp wait root /usr/lbin/bootpd bootpd
#finger stream tcp nowait bin /usr/lbin/fingerd fingerd
login stream tcp nowait root /usr/lbin/rlogind rlogind
shell stream tcp nowait root /usr/lbin/remshd remshd
exec stream tcp nowait root /usr/lbin/rexecd rexecd
#uucp stream tcp nowait root /usr/sbin/uucpd uucpd
#ntalk dgram udp wait root /usr/lbin/ntalkd ntalkd
ident stream tcp wait bin /usr/lbin/identd identd

##
#
# Other HP-UX network services
#
##
printer stream tcp nowait root /usr/sbin/rlpdaemon rlpdaemon -i

##
#
# inetd internal services
#
##
#daytime stream tcp nowait root internal
#daytime dgram udp nowait root internal
#time stream tcp nowait root internal
#time dgram udp nowait root internal
#echo stream tcp nowait root internal
#echo dgram udp nowait root internal
#discard stream tcp nowait root internal
#discard dgram udp nowait root internal
#chargen stream tcp nowait root internal
#chargen dgram udp nowait root internal

##
#
# rpc services, registered by inetd with portmap
# Do not uncomment these unless your system is running portmap!
#
##
# WARNING: The rpc.mountd should now be started from a startup script.
# Please enable the mountd startup script to start rpc.mountd.
##
#rpc stream tcp nowait root /usr/sbin/rpc.rexd 100017 1 rpc.rexd
#rpc dgram udp wait root /usr/lib/netsvc/rstat/rpc.rstatd 100001 2-4 rpc.rstatd
#rpc dgram udp wait root /usr/lib/netsvc/rusers/rpc.rusersd 100002 1-2 rpc.rusersd
#rpc dgram udp wait root /usr/lib/netsvc/rwall/rpc.rwalld 100008 1 rpc.rwalld
#rpc dgram udp wait root /usr/sbin/rpc.rquotad 100011 1 rpc.rquotad
#rpc dgram udp wait root /usr/lib/netsvc/spray/rpc.sprayd 100012 1 rpc.sprayd

##
#
# The standard remshd and rlogind do not include the Kerberized
# code. You must install the InternetSvcSec/INETSVCS-SEC fileset and
# configure Kerberos as described in the SIS(5) man page.
#
##
kshell stream tcp nowait root /usr/lbin/remshd remshd -K
klogin stream tcp nowait root /usr/lbin/rlogind rlogind -K


##
#
# NCPM programs.
# Do not uncomment these unless you are using NCPM.
#
##

#ncpm-pm dgram udp wait root /opt/ncpm/bin/ncpmd ncpmd
#ncpm-hip dgram udp wait root /opt/ncpm/bin/hipd hipd

dtspc stream tcp nowait root /usr/dt/bin/dtspcd /usr/dt/bin/dtspcd
rpc xti tcp swait root /usr/dt/bin/rpc.ttdbserver 100083 1 /usr/dt/bin/rpc.ttdbserver
registrar stream tcp nowait root /etc/opt/resmon/lbin/registrar /etc/opt/resmon/lbin/registrar
recserv stream tcp nowait root /usr/lbin/recserv recserv -display :0
rpc dgram udp wait root /usr/dt/bin/rpc.cmsd 100068 2-5 rpc.cmsd
swat stream tcp nowait.400 root /opt/samba/bin/swat swat
instl_boots dgram udp wait root /opt/ignite/lbin/instl_bootd instl_bootd
ldcconn stream tcp nowait root /opt/hpldc/bin/ldcconn ldcconn
omni stream tcp nowait root /opt/omni/lbin/inet inet -log /var/opt/omni/log/inet.log

[V. V. Ravi Kumar_1]

Hi,

You can supply a banner file to telnetd with -b option. see man page for telnetd. for telnetd line in /etc/inetd.conf add
-b /etc/issue and reread inetd.conf

inetd -c

Regards

[Steven E. Protter]

In inetd.conf this is the line you need.

telnet stream tcp nowait root /usr/lbin/telnetd telnetd -b /etc/issue

This will work for telnet and secure shell.

Permission on /etc/issue should let any user read it.

SEP

[S.K. Chan]

Just an additional note I thought may be useful to you. There is no need for a space after the -b or -B. Example ..
telnet stream tcp nowait root /usr/lbin/telnetd telnetd -b/etc/issue
login stream tcp nowait root /usr/lbin/rlogind rlogind -B/etc/issue
If you run ..
$ man telnetd
and you'll see one example in there. As far as the ownership/permission goes, 444 and bin:bin is just fine.

[Peter Gillis]

Thanks everyone, you're worth your weight in gold!

inetd.conf file change worked its stuff.
Maria.