SMTP-Turn It OFF?

[Global Server Operation]

HP 9000/L3000 OS 11.i


I am asked to satisfy an audit request to turn off SMTP and Finger. How do I do this?

[Sridhar Bhaskarla · Accepted solution]

Hi,

To turn-off sendmail running as a daemon, do

/sbin/init.d/sendmail stop and then edit /etc/rc.config.d/mailservs and make export SENDMAIL_SERVER=0. Make sure you don't have a sendmail process running ( ps -ef|grep sendmail). With it you will not be able to receive mail on the box unless it is internal.

To turn-off finger, edit /etc/inetd.conf and comment out the line that starts with finger. It's a good idea to look at other lines and comment them out if you don't use them. For ex., tftp, ntalk, ident etc., Once the editing is done, refresh inetd configuration using the command 'inetd -c'.

-Sri

[Jeff_Traigle]

SMTP:

1. /sbin/init.d/sendmail stop
2. Edit /etc/rc.config.d/mailservs
3. Set SENDMAIL_SERVER=0
4. Save and quit

finger server:

1. Edit /etc/inetd.conf
2. Comment finger entry (Put # in front of it)
3. Save and quit
4. inetd -c

[Pratyush Paul_1]

Hi -

You need to comment out the smtp port 25 in your /etc/services too.

Thanks

Pratyush

[Global Server Operation]

I stopped the daemon for sendmail but I did not comment out smtp in /etc/services. I will do this. I commented out finger in /etc/services and it was already commented out in /etc/inetd.conf. I was still able to use the finger command. Is there anything else I need to do for turning off finger?

[Geoff Wild]

Stopping finger by commneting it out in the /etc/inetd.conf stops other servers from remotely running a finger on the server.

finger will always work on the local host - unless you remove the binary...

/usr/bin/finger

Rgds...Geoff

[Jeff Schussele]

Commenting out SMTP is /etc/services is not really necessary. As long as the SendMail daemon is not running, nothing will be listening on port 25.
Just make sure you set SENDMAIL_SERVER=0 in the /etc/rc.config.d/mailservs file so it won't start at boottime.

My $0.02,
Jeff

[Global Server Operation]

What about commenting ot finger in /etc/services? Will that harm anything?

[Jeff Schussele]

No - it won't harm anything.
/etc/services is just a lookup file so the system can put a name on a service.
Although in a few cases it can stop a service from responding. It all depends on how the service is coded. If the code *requires* a services entry then commenting it out can halt the service. But not all do that.

Rgds,
Jeff

[Sridhar Bhaskarla]

Hi,

/etc/services is a mere lookup file for service to port. Most of the programs have been designed to get their port information from /etc/services (getservent) than having the port hardcoded in the code. So, uncommenting it in services is an extra measure.

inetd is responsible for listening at this port for fingered. If 'finger' is not present in /etc/services will cause inetd to give out the error "unknown service". But turning off finger in inetd.conf is the sureway to disable finger.

-Sri

[Global Server Operation]

Thanks everyone. I really appreciate the feedback. Very helpful information.