Ping,Telent

[David_492]

Dear aLL

could any body tell me how i can prevent anybody outside to ping or telnet to my servers?without using SSH.

my servers are HPUX-rp8400

[Thierry Poels_1]

Hi,

the most secure way is to block this on the firewall.

You can have a look at /var/adm/inetd.sec to block addresses/address ranges, but if somebody can logon to another server on your LAN, he might be able to ping/telnet from that server.

good luck,
Thierry.

[blal]

Hi

You can do it in the inetd security file .

/var/adm/inetd.sec .

After doing the modification do inetd -c to force inetd demon to read the config file.

[Sanjay_6]

Hi,

to disable telnet, edit the /etc/inetd.conf file and comment out "#" the line starting with telnet.

telnet stream tcp nowait root /usr/lbin/telnetd telnetd

And then run inetd -c to force inetd to reread its configuration.

You cannot disable ping to your system. Also disabling telnet could be a risky move. So be carefule before you do something like that.

Hope this helps.

Regds

[Steven E. Protter]

The ping part might requier ipfilter.
http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B9901AA


The telnet as noted can be done by disabling telnet or the inetd.sec change noted above.

If I'm wrong about the ping part, I'd like to see an inetd.sec example that shows how to disable ping(if this were my question that would be the prerequisite for earning a bunny).

SEP

[Ron Kinner]

You can partly turn off pings with:

ndd -set /dev/ip ip_respond_to_echo_broadcast 0

This will keep it from responding to broadcasts (a.b.c.255) but it will still want to respond to a direct request.


http://www.cromwell-intl.com/security/security-stack-hardening.html

also recommends:

ndd -set /dev/ip ip_forward_directed_broadcasts 0

ndd -set /dev/ip ip_respond_to_address_mask_broadcast 0

ndd -set /dev/ip ip_respond_to_timestamp_broadcast 0

ndd -set /dev/ip ip_respond_to_address_mask_broadcast 0

ndd -set /dev/ip ip_respond_to_timestamp_broadcast 0

Ron

[David_492]

I tried to use the command

ndd -set/dev/ip ip_respond_to_echo_broadcast 0

and i use other commands but always i got module ' ndd.......' invalid argument any body has an idea inorder to disable ping.

[Ron Kinner]

Not sure why it doesn't show but there is a space between -set and /dev... on all of the commands.

Ron

[Brian Lee_4]

You can not set up blocking "ping" in a server but do it in firewall.
However, you can set which IP address can or cannot telnet in to the server in /var/adm/inetd.sec file.
After you finish configuring the file, run "inetd -c" to refresh network setting.