What are TCP small services

[Gord Moore]

For a Security review, I have to disallow TCP small services if I am not using them.

What are they (I can't seem to find a complete list) ?
How do I tell if they are being used, as opposed to just being turned on?
How do I turn them off so I am sure that they won't get turned back on?

[James R. Ferguson]

Hi:

I suspect you mean services like 'daytime', 'echo', 'chargen'. You can comment out these in '/etc/inetd.conf'.

Regards!

...JRF...

[Patrick Wallek]

I am not entirely sure what you mean by "TCP small services".

Any TCP or UDP services that you do not want to use can be turned off via /etc/services and /etc/inetd.conf files. Just comment out the appropriate lines in the files and do an 'inetd -c' to have inetd re-read the config files.

[Uday_S_Ankolekar]

TCP small services are echo, chargen, daytime, time and discard; the Berkeley r* services, talk, etc. You can configure them in inetd.conf. Start by removing all services from inetd.conf and then restart inetd daemon.

Check for netstat command for more information .
Good Luck,
-USA..

[Gord Moore]

I'm glad to see others are confused too. I am not sure what TCP small services exactly are - that's why I was asking.

From what I see so far, the way to find out if people are using it is to turn it off and see what breaks.

I believe the netstat command just tells me what ports/services are open. Is there a way to monitor the usage?

[Volker Borowski]

Hi,

tcp small servers
or
no tcp small servers

is a config line from cisco IOS, which enables the previous named services on a cisco router or switch.
I am not sure, if this gives some kind of "copyright" for this phrase to cisco.
I never heard this phrase in other context than cisco.

May be the audit guy is a cisco-fan :-)

Volker

[Steven E. Protter]

Never heard of small services.

Someone misspoke to you....

[Ron Kinner]

http://www.rhyshaden.com/ip_small.htm

lists IP small services though some souces consider small services to be anything under port 20 plus port 37.

inetd -l
will turn on logging of connection attempts.

http://people.hp.se/stevesk/bastion.html

is a good reference to how to secure your system.

snort (www.snort.org) will do a good job of telling you who is doing things you might want to know about.

Ron

[Uday_S_Ankolekar]

Use netstat -af or if you have lsof use lsof -i .You get more detailed info by using lsof command.

[A. Daniel King_1 · Accepted solution]

I've seen one other place where "little" services are mentioned:

http://netsecurity.ualr.edu/Tips/UNIX-1.htm

This is Solaris mainly, but the concepts apply.

Some services cannot be shut off in inetd.conf, and there are ports which can be shut off outside of the "small" or "little" range. All open ports which are visible to the outside world have their exploits.

Some services are started in the /sbin/rc hierarchy (sendmail, NFS, rpc, etc.) and some services are not mentioned in inetd.conf (xfs and X come to mind) at all.

echo is shut down in an entirely different manner from these above. See:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x432b36e69499d611abdb0090277a778c,00.html

I'd try this ndd command, but I'm not tinkering with my production HP today!

Ping (echo) is used by many monitoring programs, so be aware that disabling this may generate a "down server" response from your monitoring software.

I like nmap for port scanning my hosts just to see what is running, then coordinating this information back to lsof output to get additional information.

http://www.insecure.org/nmap/nmap_download.html

Even an old version of nmap would be useful, if you don't want to compile your own.

Let us know how it goes.

[Bill Hassell]

Here is a list of the most common services that should be turned off. Virtually no modern system uses these ports so they should be disabled:

# uucp stream tcp nowait root /usr/sbin/uucpd uucpd
# ntalk dgram udp wait root /usr/lbin/ntalkd ntalkd
# daytime stream tcp nowait root internal
# daytime dgram udp nowait root internal
# time stream tcp nowait root internal
# time dgram udp nowait root internal
# echo stream tcp nowait root internal
# echo dgram udp nowait root internal
# discard stream tcp nowait root internal
# discard dgram udp nowait root internal
# chargen stream tcp nowait root internal
# chargen dgram udp nowait root internal

A few systems may need these services:

# tftp dgram udp wait root /usr/lbin/tftpd tftpd
# bootps dgram udp wait root /usr/lbin/bootpd bootpd
# finger stream tcp nowait bin /usr/lbin/fingerd fingerd
# kshell stream tcp nowait root /usr/lbin/remshd remshd -K
# klogin stream tcp nowait root /usr/lbin/rlogind rlogind -K
# dtspc stream tcp nowait root /usr/dt/bin/dtspcd /usr/dt/bin/dtspcd
# rpc xti tcp swait root /usr/dt/bin/rpc.ttdbserver 100083 1 /usr/dt/bin/rpc.ttd
bserver
# rpc dgram udp wait root /usr/dt/bin/rpc.cmsd 100068 2-5 rpc.cmsd
# recserv stream tcp nowait root /usr/lbin/recserv recserv -display :0

When it comes to security, I am ruthless--I turn off anything I don't know about and wait for a request or problem before turning it back on.