w PROM will need to be ordered from Sun.
The first step in network security is to prevent unauthorized entry by disabling access to specific IP ports, as defined by individual entries in the services database. This action prevents specific services from operating, even if the inetd attempts to accept a connection for a service because it is still defined in /etc/inetd.conf. In this section, we will examine how to disable specific services from inetd, in conjunction with the services database.
The following services are typically enabled in /etc/services and configured in /etc/inetd.conf. Most sites will want to disable them, and install more secure equivalents. For example, the ftp and telnet services may be replaced by the encrypted secure copy and secure shell programs, respectively. To disable the ftp, telnet, shell, login, exec, comsat, talk, uucp, and finger services, we would “comment out” their entries in /etc/inetd.conf by inserting a hash character “#” at the first character position of the line that defines the service. The following configuration enables the ftp, telnet, shell, login, exec, comsat, talk, uucp, and finger services in /etc/inetd.conf:
ftp stream tcp nowait root /usr/sbin/in.ftpd in.ftpd -l telnet stream tcp nowait root /usr/sbin/in.telnetd in.telnetd shell stream tcp nowait root /usr/sbin/in.rshd in.rshd login stream tcp nowait root /usr/sbin/in.rlogind in.rlogind exec stream tcp nowait root /usr/sbin/in.rexecd in.rexecd comsat dgram udp wait root /usr/sbin/in.comsat in.comsat talk dgram udp wait root /usr/sbin/in.talkd in.talkd uucp stream tcp nowait root /usr/sbin/in.uucpd in.uucpd finger stream tcp nowait nobody /usr/sbin/in.fingerd in.fingerd
The following configuration disables the ftp, telnet, shell, login, exec, comsat, talk, uucp, and finger services in /etc/inetd.conf:
#ftp stream tcp nowait root /usr/sbin/in.ftpd in.ftpd -l #telnet stream tcp nowait root /usr/sbin/in.telnetd in.telnetd #shell stream tcp nowait root /usr/sbin/in.rshd in.rshd #login stream tcp nowait root /usr/sbin/in.rlogind in.rlogind #exec stream tcp nowait root /usr/sbin/in.rexecd in.rexecd #comsat dgram udp wait root /usr/sbin/in.comsat in.comsat #talk dgram udp wait root /usr/sbin/in.talkd in.talkd #uucp stream tcp nowait root /usr/sbin/in.uucpd in.uucpd #finger stream tcp nowait nobody /usr/sbin/in.fingerd in.fingerd
Similarly, the following configuration enables the ftp, telnet, shell, login, exec, comsat, talk, uucp, and finger services in /etc/services:
ftp 21/tcp telnet 23/tcp shell 514/tcp cmd login 513/tcp exec 512/tcp biff 512/udp comsat talk 517/udp uucp 540/tcp uucpd finger stream tcp nowait nobody /usr/sbin/in.fingerd in.fingerd
Similarly, the following configuration disables the ftp, telnet, shell, login, exec, comsat, talk, uucp, and finger services in /etc/services:
#ftp 21/tcp #telnet 23/tcp #shell 514/tcp cmd #login 513/tcp #exec 512/tcp #biff 512/udp comsat #talk 517/udp #uucp 540/tcp uucpd #finger stream tcp nowait nobody /usr/sbin/in.fingerd in.fingerd