inetd question - What can I turn off?

[Darrell Tschakert]

Hi,
We have some HP-UX 11.23 system - rx4640 and rx2620's. These computers are Oracle servers.

I am told that we should turn off any of the inetd services that we do not need. Is there any real reason why I need the following?

#daytime stream tcp6 nowait root internal
#daytime dgram udp6 nowait root internal
#time stream tcp6 nowait root internal
#time dgram udp6 nowait root internal
#echo stream tcp6 nowait root internal
#echo dgram udp6 nowait root internal
#discard stream tcp6 nowait root internal
#discard dgram udp6 nowait root internal
#chargen stream tcp6 nowait root internal
#chargen dgram udp6 nowait root internal

What about recserv and tftp?

I have had these turned off for some time on one of our servers and have seen nothing out of the ordinary.

Can anyone point me at a document that goes over these services and tells me what to turn off with security being an important factor?

Thank you,

Darrell Tschakert

[Moises Acevedo · Accepted solution]

My tip would be to download the CIS Benchmarking tool .pdf file for HP-UX.

It mentions each change you could make to this file and others in the HP-UX Security Hardening efforts!

http://www.cisecurity.org/bench_hpux.html

Regards,
Moises

[Sundar_7]

I dont have a document but there can only be document describing what a service does. It will be upto you to decide if you want to turn them off or not. Because what may be unnecessary in one shop may be a necessity in others !

That said, tftp is a big NO-NO in the security world. Unless you are using this as a Ignite-UX server or as a storage for network devices bootup configuration, you should probably disable the tftp.

If security is of concern, telnet and other r-services should also be disabled and use Secure couterparts.

[James R. Ferguson]

Hi Darrell:

Bastille comes as part of 11.23 and offers you the ability to lock-down your server to various levels. You can run the tool interactively and select what you want. Locking out the about 'inted' services are one option. A record of the actions you take is generated as well as a "revert" script. You might begin here:

http://www.docs.hp.com/en/5991-5526/ch03s05.html#babebhbi

Regards!

...JRF...

[Darrell Tschakert]

Thanks for the advice.
Yes, I should have gone to the CIS Benchmark document. Why didn't I go there first? The Benchmark document said to turn just about everything off. It turned out that I had to turn auth back on for the Service Guard machines. I turned off tftp since I could find nothing that used it.

I left the Service Guard cluster daemon lines turned on.
I am still looking in to "instl_boots" and "registrar". I think that EMS needs "registrar" to monitor devices, etc. I still haven't read about "instl_boots", but will do so.

Thanks again.