strange process of inetd

[jack Hu_1]

Dear Sir:
someone try to guess the passwd of my HPUX server.He use the xscan tool.
But after he scan the server,the process
will still on the server.
the process like this:
inetd -echo [ip address(his address)]
inetd -discard [ip address(his address)]
and there are about 30 process on my server.
But not all my servers,will still have these processes.
Can someone help me,and give me some suggestion.
All the impact servers including 10.20,11.0 OS.
Best Regards.
Jack Hu

[hpuxrox]

Yes,

Port scanners can produce undesirable affects to a system. One of which could be maxing out system resources such as nproc or nfiles from the socket connections. I would advice disabling any services within /etc/inetd.conf that you do not use.

-Yates

[Steven Sim Kok Leong · Accepted solution]

Hi,

echo and discard are both unnecessary services on your system. As security best practice, you should prevent them from being spawned off by inetd by commenting them out of /etc/inetd.conf:

# vi /etc/inetd.conf
#echo stream tcp nowait root internal
#echo dgram udp nowait root internal
#discard stream tcp nowait root internal
#discard dgram udp nowait root internal

Reload inetd configuration:

# inetd -c

The processes will timeout depending on your keepalive interval. Alternatively, you can simply terminate them by using the kill command.

Hope this helps. Regards.

Steven Sim Kok Leong

[Victor_5]

comment out "echo" and "discard" services in /etc/inetd.conf and /etc/services for security reason, after that, run

inetd -c

to reread the modified configuration file.

By the way, for future security issue, you also need to comment out in /etc/inetd.conf:
chargen
ntalk
bootps
daytime
shell
tftp

in /etc/services
bootps
bootpc
chargen
daytime
finger
ntalk
talk
route
tftp
uucp

Good luck!