Identify /etc/inetd.conf services that can be disabled

[Tim Ryan]

I'd like to identify the services that aren't being used in /etc/inetd.conf and disable them. Is there an easy way to track what I'm using and what's safe to delete? I'm running in a MC/ServiceGuard environment and I don't want to disable any of my running packages functionalities.

Any ideas would be appreciated!

[harry d brown jr]

http://people.hp.se/stevesk/bastion.html

live free or die
harry

[James R. Ferguson · Accepted solution]

Hi Tim:

You're free to disable what you don't want. 'echo', 'chargen', 'daytime' and 'discard' are good candidates for removal as they are most useful on test servers for socket and network developement and are potentially exploitable for ill. Do *not* disable services named 'hacl-'. These are your (H)gh-(A)vailability (CL)uster ones!

Regards!

...JRF...

[Craig Rants]

If you are interested in securing you box with this file, this link may be of interest.

Good Luck,
C
http://www.uwsg.indiana.edu/security/inetd.html

[Bill Hassell]

You can take the approach: nothing until proven that I need it. So comment out everything except telnet and ftp...later, you might add login/shell/exec (the 'r' commands) but it all depends on how secure you want to be. Leave out bootpd, finger, ntalk and ident as well as the rpc stuff unless you need it...but get a good reason.

[Tim Ryan]

What is ident?

-Tim

[James R. Ferguson]

Hi Tim:

From the man pages (1M) for 'identd':

"identd is a server which implements the TCP/IP proposed standard IDENT user identification protocol as specified in the RFC 1413 document.

identd operates by looking up specific TCP/IP connections and returning the user name of the process owning the connection."

Regards!

...JRF...

[Roger Baptiste]

<>

Identification protocol
To get live info on any port,
you can do
telnet portnumber

-raj

[Bill Hassell]

Since ident provides information about user names on the target system, it is a security risk to leave it running. Same with fingerd.