Network Services - system access

[Peter Gillis]

HI,
UX11.00

What are would happen if disallow this service.
chargen Inetd internal server ARPA Allowed

I cant find info for chargen ? Would someone be able to give a location of this type of data and other system access info, Not too in depth - at the moment just want to know the basics - like why allow access / why disallow access.
Thanks
Maria

[Sridhar Bhaskarla · Accepted solution]

Hi Maria,

chargen as indicated by it's name - character generator. This can be safely turned off.

Try this for fun

telnet your_system 19

There are other services like daytime, echo, tftp, ntalk, finger, ident and other rpc services that you may not require. However, check with the users on the box to see if the application uses them by anychance. Once comment them out, you will need to 'inetd -c' to refresh the configuration.

-Sri

[Patrick Wallek]

From TKB document KBRC00001288

chargen (TCP and UDP port 19) - echos complete set of character
set repeatedly on this port upon connection


I would disable this and other extraneous services in inetd.conf.

[Peter Gillis]

How come I can go into sam system access and modify system permissions to denied; and then I can look at the inetd.conf file and chargen is still there with no comment out character.
Can I not disable the chargen service via sam?

Thanks.
Maria

[Bill Hassell]

HP-UX enables most all of the services in /eetc/inetd.conf--it assumes that you know you should turn off these archaic or specialized network services (chargen tftp daytime ntalk uucp ident time echo discard finger bootps printer rpc.).

In the world of security, it is much safer to deny everything in inetd.conf and add back a denied service if it is truly required. I would start with everything commented out except telnet and perhaps ftp. Look at shell and exec since these may be misused. In the above list, you should also check on ident. bootps, printer, tftp as a possibly required service. The rest are almost never used in typical HP-UX systems.

[Sridhar Bhaskarla]

SAM does modify /var/adm/inetd.sec. If you view that file, you will see a line called

chargen deny

And that's what your SAM action did.

This is effectively equivalent to disabling it in /etc/inetd.conf.

-Sri

[Patrick Wallek]

Look in your /var/adm/ directory and see if you have a file called inetd.sec there. SAM could possibly be modifying this file to deny access to inetd services.

For more information do a 'man inetd.sec'.

[Peter Gillis]

Bill, How/where would I find info on just what the indidual services are:
chargen tftp daytime ntalk uucp ident time echo discard finger bootps printer rpc.
I am feeling cautious about denying access to some of the services eg time echo finger etc, because I am thinking that they might stop the actual cmds echo finger or even the date command from working correctly. I have a feeling that this sounds pretty naive, but I would rather be sure than stuff things up.

Thanks Maria.

[Bill Hassell]

These are all network services and have nothing to do with similar commands in HP-UX. The date command has no relationship to the date network service. finger (actually, fingerd in inetd.conf) does not affect the local finger command. fingerd is a hacker's favorite tattletale about a remote system. You don't want to advertise user information across the network. Same with echo, etc. These services are network daemons that provide the named service for a remote requestor. The man page for each service (the program's name is on the righthand side of the inetd.conf listing) is available and describes what it provides.

Since you can disable and re-enable services in inetd.conf without rebooting, you can start by commenting out something like finger(d), then run inetd -c and try the finger command to see that it still works. Then try the remote finger format pointed to another Unix system where fingerd is enabled:

finger root@remote_machine

Connection refused will be the response if fingerd is not enabled. Otherwise, you'll gain access to user information on the remote machine without ever logging in--which is why fingerd should be disbled.