Inetd Security

[Matthew Whitaker]

Can anyone point me to some good resources that detail what services are included in inetd.conf by default and what they do? My company is working to increase our security, and would like to ensure that any uneeded or potentially insecure services included in inetd.conf are stopped from running.

[harry d brown jr]

http://docs.hp.com/en/B2355-90685/ch02s04.html

basically search http://docs.hp.com

live free or die
harry d brown jr

[harry d brown jr]

http://www.blacksheepnetworks.com/security/resources/hp-ux11.html

live free or die
harry d brown jr

[Simon Hargrave]

If you are looking into security, i recommend you download and run the Bastille software.

This software will check various aspects of server security (including inetd) and give recommendations and details information about the services/issues it finds.

If you run it on one of your test boxes you can get a list of recommendations with details descriptions, which you can cut/paste into a report for your bosses ;)

Find it on http://software.hp.com

[Doug Burton]

Hope this helps: http://web.tampabay.rr.com/batcave/inetd_conf.htm

[roger_122]

Matthew

Take a look at:

http://www.cisecurity.org/

There is a benchmark tool for HPUX ..

Regards

Roger

[Jeff_Traigle]

There's actually not much in the stock inetd.conf that should be running. FTP and telnet are insecure and should be disabled. tftp should be off unless it's an Ignite server or boot server for some device that requires the service. bootps should be off unless it's an Ignite server or general purpose Bootp/DHCP server. finger, r-services, uucp, ntalk, ident... all bad or useless and should be disabled. The rlpdaemon service not needed unless it's a print server. Inetd internal services, useless and should be disabled. rpc services are disabled by default, I believe. Kerberized r-services not needed most places and should be disabled.

[MZ_1]

Here is a checklist from cert. I agree with jeff. you'll probably be left with telnet and ftp when your done editing. then you can look at secure shell.

http://www.cert.org/tech_tips/usc20_full.html

[Alzhy]

Matthew,

Best secure configuration for any UNIX system is to have NOTHING in /etc/inetd.conf. Your well-known INET services ftp, telnet, logind, etc.. should be replaced by Secure Shell.

All of our UNIX servers now have blank inetd.conf configs. We use Secure Shell to replace clear text protocols line telnet, ftp, rlogin, rexec.. etc.