ntp/external

[Nobody's Hero]

I recently punched a hole through the firewall so my HPUX time server could get to the outside world for a valid time source, all is well. Question, are there any process I should shut down on this HPUX box to prevent intrusion? I am a little worried about an outsider coming in on one of my services.

[Hazem Mahmoud_3]

Generally the rule is if you don't need it then turn it off. Go to /etc/services and comment out ("#") any lines. Also check the /etc/inetd.conf file and remove any services that you do not need. If the only purpose of this HPUX server is to function as a time server than you can get rid of a whole lot.

-Hazem

[Michael Schulte zur Sur]

Hi,

it depends on how big the hole is, you punched into the firewall. ;-) You only need a hole the size of the port that is needed for ntp, or am I wrong?

be careful,

Michael

[Bill Hassell]

The NTP port (123) is considered to be safe. If your firewall has just one port open, then the rest of the services can't be seen or reached from outside the firewall (assuming you have a good firewall and a good administrator). But good security demands that all ports be closed by default and then an explicit decision to run a service (open a port) made based on corporate guidelines. Most security problems come from inside the firewall.

[RAC_1]

You can close the services that you do not want. (Check /etc/services and /etc/inetd.conf)

A tool like nmap can give you idea on what ports are open on ur server.

[Steven E. Protter]

A agree with Bill Hassell. Port 123 is safe.

My employer disagrees with that, so they have the firewall act as a time server and ntp must be configured to take time off of that port.

If you are worried and don't trust your firewall, ipfilter can be installed on the hp box and configured to allow only one way traffic on port 123. Your machine will be able to go out and get the time but nothing will be able to come in on 123.

I can probably dig up a configuration for you if you are interested.

SEP