telnet deny

[Chang_6]

Hi,
could someone tell what the syntax for "telnet deny" in /var/adm/inetd.sec is?

Is it just "telnet deny"? If so, what does it stand for.

Please suggest. Thanks

[Philip Chase]

That is your inetd security file that syntax tells the system to refuse telnet calls.

Try "man inetd.sec" for more info.

[Robert-Jan Goossens]

Hi,

Add the following lines to /var/adm/inetd.sec:



telnet deny

Execute the 'inetd -c' command to re-initialize the inet daemon.

Reagrds,
Robert-Jan

[Patrick Wallek · Accepted solution]

You must specify a host name or ip address or a portion of an ip address within inetd.sec.

telnet deny 1.2.3.4 5.6.7.8 hosta hostb

The above would deny telnet access from machines with ip addresses of 1.2.3.4 and 5.6.7.8 and hosts named hosta and hostb.

As said the inetd.sec man page has good information and the inetd.sec file is documented very well itself.

[Chang_6]

Hi,

If all the machines should be denied access, is it just plain "telnet deny" or "telnet deny *"?

[Suresh Pai]

Another way of disabling telnet entirely is to comment it out in the inetd.conf file, and reinitialize the inetd service.

[Sanjay_6]

Hi,

In such a situation, you can deny the telnet service by commenting out the telnet entry in the /etc/inetd.conf file and making inetd reread the conf file.

Hope this helps.

Regds

[Chang_6]

Hi,

Commenting out that line has been done too.

However, I would like to know if it is just

"telnet deny" or "telnet deny *"?

Thanks!

[Jeff_Traigle]

The examples in inetd.sec show no * to specify all hosts, but either way should work, I would think.

[Jeff_Traigle]

That should have said inetd.sec(4)... read the man page.

[Sanjay_6]

Hi,

The syntax could be

telnet deny

or

telnet deny *

either one works.

Hope this helps.

Regds

[Chang_6]

Hi,

When telnet and ftp are disabled, should tftp be disabled? I know tftp stands for file transfer protocol .. especially in a webserver env where ftp is disabled?


Please suggest

[Jeff_Traigle]

TFTP (Trivial File Transfer Protocol) should usually be disabled on any server. Just like any other service, if you don't have a legitimate need for it on the system, it shouldn't be running. The only time you really need TFTP enabled is to serve binaries to diskless devices that can't use NFS or other means of retrieving their boot image.

[Chang_6]

Hi,

Thanks for the reply. Should I put "tftp deny" just like "telnet deny" in /var/adm/inetd.sec? Also, the following appears in /etc/inetd.conf

# Before uncommenting the "tftp" entry below, please make sure
# that you have a "tftp" user in /etc/passwd. If you don't
# have one, please consult the tftpd(1M) manual entry for
#tftp dgram udp wait root /usr/lbin/tftpd tftpd


I don't have a tftp user in /etc/passwd.

Any ideas?

[Chang_6]

Hi,

ANother question, what is the quick way to find whether the system has "legitimate need" of it? How to find if the system is already depending on it?

[Muthukumar_5]

If your tftp service on /etc/inetd.conf file is commented then no need to care tftp service to be blocked on inetd.sec file.

It is not in ready to service the requests there. If you want to start the service and use the one then create user for tftp as in tftpd man page there.

As
tftp:*:510:101:tftp server:/home/tftpdir:/usr/bin/false

If you don't want that service then don't care on inetd.sec file

[Tom Danzig]

Keep in mind that tftp is needed on Ignite network recovery servers. If you are not using network recover, you should not have problems disabling it.

[Muthukumar_5]

We can find the service (tftp) is being currently used with lsof tool. It is good to know weather particular service running on not. service informations are given in /etc/services file.
tftp 69/udp # Trivial File Transfer Protocol

See
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=650197
for lsof there

[Sanjay_6]

Hi,

There is no sure way of knowing whether a service is required or not on the system. The only way to verify whether a service is needed or not is to shutdown / diable the service and see if someone complains. You can also try and see if you want to put a tcp wrapper around the service which will over a period tell you who had been using the service. You can download tcp wrapper from this location,

http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/tcp_wrappers-7.6/

Hope this helps.

Regds

[Chang_6]

Hi, Thanks for the responses. tftp is listed in /etc/servcies as "tftp 69/udp"

However, lsof command doesn't work here. I am thinking to leave it commented and not worry about inetd.sec. However, is there any other way to check if it is currently active or supposed to be active?

[Muthukumar_5]

Yes. With netstat command as,

netstat -na | grep -w '69'
or
netstat -na | grep '69'

If it is having as LISTEN there then it is running.

Else we can know the service startup by syslog file more.

grep tftp /var/adm/syslog/syslog.log

If it is having some entries there, then it is started.

We can know the current usage with ps itself as,

ps -ef | grep -v grep | grep tftpd

[Chang_6]

Hi,

netstat -na | grep listen didn't show any tftp entry. similarily, netstat -na | grep 69. However, on the webservers, tftp is enabled.

Syslog has:
Dec 11 12:43:30 do34ty inetd[683]: tftp/udp: Added service, server /usr/lbin/t

/etc/inetd.conf has tftp entry:

tftp dgram udp wait root /usr/lbin/tftpd tftpd\

The system is a webserver. Please confirm if this has to be removed.

Why is tftp enabled here? Could you tell what could be the possible reason?

Also, please suggest if there are any things that i need to care for (other than tftp, ftp, telnet)

Many thanks for all the help so far.

[Sanjay_6]

Hi,

tftp is a service which is not used except by ignite servers. If this is not an ignite server you can comment out tftp in /etc/inetd.conf or deny access to tftp using the inetd.sec file.

You can also look into the Bastille software available from hp software site.

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6849AA

Take a look at this thread too,

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/5187-2216/5187-2216_top.html&con=/hpux/onlinedocs/5187-2216/00/01/113-con.html&toc=/hpux/onlinedocs/5187-2216/00/01/113-toc.html&searchterms=bastille&queryid=20040921-122040

Hope this helps.

regds

[Chang_6]

Hin

Thanks, could you please tell what "ignite servers" are? Ours is 11.00.

Also, any other things that I have to check on a machine or web server?

I've already looked into telnet, ftp, tftp.

[Chang_6]

Hi

Thanks, could you please tell what "ignite servers" are? Ours is 11.00.

Also, any other things that I have to check on a machine or web server?

I've already looked into telnet, ftp, tftp.