inetd/bootps |
inetd |
/etc/inetd.conf |
bootp services to diskless clients |
- Necessary for Network Installation Management (NIM) and remote
booting of systems
- Works concurrently with tftp
- Disable in most cases
|
inetd/chargen |
inetd |
/etc/inetd.conf |
character generator (testing only) |
- Available as a TCP and UDP service
- Provides opportunity for Denial of Service attacks
- Disable unless you are testing your network
|
inetd/cmsd |
inetd |
/etc/inetd.conf |
calendar service (as used by CDE) |
- Runs as root, therefore a security concern
- Disable unless you require this service with CDE
- Disable on back room database servers
|
inetd/comsat |
inetd |
/etc/inetd.conf |
Notifies incoming electronic mail |
- Runs as root, therefore a security concern
- Seldom required
- Disable
|
inetd/daytime |
inetd |
/etc/inetd.conf |
obsolete time service (testing only) |
- Runs as root
- Available as a TCP and UDP service
- Provides opportunity for a Denial of Service PING attacks
- Service is obsolete and used for testing only
- Disable
|
inetd/discard |
inetd |
/etc/inetd.conf |
/dev/null service (testing only) |
- Available as TCP and UDP service
- Used in Denial of Service Attacks
- Service is obsolete and used for testing only
- Disable
|
inetd/dtspc |
inetd |
/etc/inetd.conf |
CDE Subprocess Control |
- This service is started automatically by the inetd daemon in response to a CDE client requesting a process
to be started on the daemon's host. This makes it vulnerable to attacks
- Disable on back room servers with no CDE
- CDE might be able to function without this service
- Disable unless absolutely needed
|
inetd/echo |
inetd |
etc/inetd.conf |
echo service (testing only) |
- Available as UDP and TCP service
- Could be used in Denial of Service or Smurf attacks
- Used to echo at someone else to get through a firewall or start
a datastorm
- Disable
|
inetd/exec |
inetd |
/etc/inetd.conf |
remote execution service |
- Runs as root user
- Requires that you enter a user ID and password, which are passed
unprotected
- This service is highly susceptible to being snooped
- Disable
|
inetd/finger |
inetd |
/etc/inetd.conf |
finger peeking at users |
- Runs as root user
- Gives out information about your systems and users
- Disable
|
inetd/ftp |
inetd |
/etc/inetd.conf |
file transfer protocol |
- Runs as root user
- User id and password are transferred unprotected, thus allowing
them to be snooped
- Disable this service and use a public domain secure shell suite
|
inetd/imap2 |
inetd |
/etc/inetd.conf |
Internet Mail Access Protocol |
- Ensure that you are using the latest version of this server
- Only necessary if you are running a mail server. Otherwise, disable
- User ID and password are passed unprotected
|
inetd/klogin |
inetd |
/etc/inetd.conf |
Kerberos login |
- Enabled if your site uses Kerberos authentication
|
inetd/kshell |
inetd |
/etc/inetd.conf |
Kerberos shell |
- Enabled if your site uses Kerberos authentication
|
inetd/login |
inetd |
/etc/inetd.conf |
rlogin service |
- Susceptible to IP spoofing, DNS spoofing
- Data, including User IDs and passwords, is passed unprotected
- Runs as root user
- Use a secure shell instead of this service
|
inetd/netstat |
inetd |
/etc/inetd.conf |
reporting of current network status |
- Could potentially give network information to hackers if run on
your system
- Disable
|
inetd/ntalk |
inetd |
/etc/inetd.conf |
Allows users to talk with each other |
- Runs as root user
- Not required on production or back room servers
- Disable unless absolutely needed
|
inetd/pcnfsd |
inetd |
/etc/inetd.conf |
PC NFS file services |
- Disable service if not currently in use
- If you need a service similar to this, consider Samba, as the
pcnfsd daemon predates Microsoft's release of SMB specifications
|
inetd/pop3 |
inetd |
/etc/linetd.conf |
Post Office Protocol |
- User IDs and passwords are sent unprotected
- Only needed if your system is a mail server and you have clients
who are using applications that only support POP3
- If your clients use IMAP, use that instead, or use the POP3s service.
This service has a Secure Socket Layer (SSL) tunnel
- Disable if you are not running a mail server or have clients who
need POP services
|
inetd/rexd |
inetd |
/etc/inetd.conf |
remote execution |
- Runs as root user
- Peers with the on command
- Disable service
- Use rshand rshd instead
|
inetd/quotad |
inetd |
/etc/inetd.conf |
reports of file quotas (for NFS clients) |
- Only needed if you are running NFS file services
- Disable this service unless required to provide an answer for
the quota command
- If you need to use this service, keep all patches and fixes for
this service up to date
|
inetd/rstatd |
inetd |
/etc/inetd.conf |
Kernel Statistics Server |
- If you need to monitor systems, use SNMP and disable this service
- Required for use of the rup command
|
inetd/rusersd |
inetd |
/etc/inetd.conf |
info about user logged in |
- This is not an essential service. Disable
- Runs as root user
- Gives out a list of current users on your system and peers with
rusers
|
inetd/rwalld |
inetd |
/etc/inetd.conf |
write to all users |
- Runs as root user
- If your systems have interactive users, you might need to keep
this service
- If your systems are production or database servers, this is not
needed
- Disable
|
inetd/shell |
inetd |
/etc/inetd.conf |
rsh service |
- Disable this service if possible. Use Secure Shell instead
- If you must use this service, use the TCP Wrapper to stop spoofing
and limit exposures
- Required for theXhier software ditribution program
|
inetd/sprayd |
inetd |
/etc/inetd.conf |
RPC spray tests |
- Runs as root user
- Might be required for diagnosis of NFS network problems
- Disable if you are not running NFS
|
inetd/systat |
inetd |
/etc/inted.conf |
"ps -ef" status report |
- Allows for remote sites to see the process status on your system
- This service is disabled by default. You must check periodically
to ensure that the service has not been enabled
|
inetd/talk |
inetd |
/etc/inetd.conf |
establish split screen between 2 users on the
net |
- Not a required service
- Used with the talk command
- Provides UDP service at Port 517
- Disable unless you need multiple interactive chat sessions for UNIX user
|
inetd/ntalk |
inetd |
/etc/inetd.conf |
"new talk" establish split screen between 2
users on the net |
- Not a required service
- Used with the talk command
- Provides UDP service at Port 517
- Disable unless you need multiple interactive chat sessions for UNIX user
|
inetd/telnet |
inetd |
/etc/inetd.conf |
telnet service |
- Supports remote login sessions, but the password and ID are passed
unprotected
- If possible, disable this service and use Secure Shell for remote
access instead
|
inetd/tftp |
inetd |
/etc/inetd.conf |
trivial file transfer |
- Provides UDP service at port 69
- Runs as root user and might be compromised
- Used by NIM
- Disable unless you are using NIM or have to boot a diskless workstation
|
inetd/time |
inetd |
/etc/inetd.conf |
obsolete time service |
- Internal function of inetd that is used by rdate command.
- Available as TCP and UDP service
- Sometimes used to synchronize clocks at boot time
- Service is outdated. Use ntpdate instead
- Disable this only after you have tested your systems (boot/reboot)
with this service disabled and have observed no problems
|
inetd/ttdbserver |
inetd |
/etc/inetd.conf |
tool-talk database server (for CDE) |
- The rpc.ttdbserverd runs as root user and might be compromised
- Stated as a required service for CDE, but CDE is able to work
without it
- Should not be run on back room servers or any systems where security
is a concern
|
inetd/uucp |
inetd |
/etc/inetd.conf |
UUCP network |
- Disable unless you have an application that uses UUCP
|
inittab/dt |
init |
/etc/rc.dt script in the /etc/inittab |
desktop login to CDE environment |
- Starts the X11 server on the console
- Supports the X11 Display Manager Control Protocol (xdcmp) so that
other X11 stations can log into the same machine
- Service should be used on personal workstations only. Avoid using
it for back room systems
|
inittab/dt_nogb |
init |
/etc/inittab |
desktop login to CDE environment (NO graphic
boot) |
- No graphical display until the system is up fully
- Same concerns as inittab/dt
|
inittab/httpdlite |
init |
/etc/inittab |
web server for the docsearch command |
- Default web server for the docsearch engine
- Disable unless your machine is a documentation server
|
inittab/i4ls |
init |
/etc/inittab |
license manager servers |
- Enable for development machines
- Disable for production machines
- Enable for back room database machines that have license requirements
- Provides support for compilers, database software, or any other
licensed products
|
inittab/imqss |
init |
/etc/inittab |
search engine for "docsearch" |
- Part of the default web server for the docsearch engine
- Disable unless your machine is a documentation server
|
inittab/lpd |
init |
/etc/inittab |
BSD line printer interface |
- Accepts print jobs from other systems
- You can disable this service and still send jobs to the print
server
- Disable this after you confirm that printing is not affected
|
inittab/nfs |
init |
/etc/inittab |
Network File System/Net Information Services |
- NFS and NIS services based which were built on UDP/RPC
- Authentication is minimal
- Disable this for back room machines
|
inittab/piobe |
init |
/etc/inittab |
printer IO Back End (for printing) |
- Handles the scheduling, spooling and printing of jobs submitted
by the qdaemon daemon
- Disable if you are not printing from your system because you are
sending print job to a server
|
inittab/qdaemon |
init |
/etc/inittab |
queue daemon (for printing |
- Submits print jobs to the piobe daemon
- If you are not printing from your system, then disable
|
inittab/uprintfd |
init |
/etc/inittab |
kernel messages |
- Generally not required
- Disable
|
inittab/writesrv |
init |
/etc/inittab |
writing notes to ttys |
- Only used by interactive UNIX workstation users
- Disable this service for servers, back room databases, and development
machines
- Enable this service for workstations
|
inittab/xdm |
init |
/etc/inittab |
traditional X11 Display Management |
- Do not run on back room production or database servers
- Do not run on development systems unless X11 display management
is needed
- Acceptable to run on workstations if graphics are needed
|
rc.nfs/automountd |
|
/etc/rc.nfs |
automatic file systems |
- If you use NFS, enable this for workstations
- Do not use the automounter for development or back room servers
|
rc.nfs/biod |
|
/etc/rc.nfs |
Block IO Daemon (required for NFS server) |
- Enabled for NFS server only
- If not an NFS server, then disable this along with nfsd and rpc.mountd
|
rc.nfs/keyserv |
|
/etc/rc.nfs |
Secure RPC Key server |
- Manages the keys required for secure RPC
- Important for NIS+
- Disable this if you are not using NFS and NIS and NIS+
|
rc.nfs/nfsd |
|
/etc/rc.nfs |
NFS Services (required for NFS Server) |
- Authentication is weak
- Can lend itself to stack frame crashing
- Enable if on NFS file servers
- If you disable this, then disable biod, nfsd, and rpc.mountd as well
|
rc.nfs/rpc.lockd |
|
/etc/rc.nfs |
NFS file locks |
- Disable if you are not using NFS
- Disable this if you are not using file locks across the network
- lockd daemon is mentioned in the SANS Top Ten Security
Threats
|
rc.nfs/rpc.mountd |
|
/etc/rc.nfs |
NFS file mounts (required for NFS Server) |
- Authentication is weak
- Can lend itself to stack frame crashing
- Should be enabled only on NFS file servers
- If you disable this, then disable biod and nfsd as
well
|
rc.nfs/rpc.statd |
|
/etc/rc.nfs |
NFS file locks (to recover them) |
- Implements file locks across NFS
- Disable unless you are using NFS
|
rc.nfs/rpc.yppasswdd |
|
/etc/rc.nfs |
NIS password daemon (for NIS master) |
- Used to manipulate the local password file
- Only required when the machine in question is the NIS master;
disable in all other cases
|
rc.nfs/ypupdated |
|
/etc/rc.nfs |
NIS Update daemon (for NIS slave) |
- Receives NIS database maps pushed from the NIS Master
- Only required when the machine in question is a NIS slave to
a Master NIS Server
|
rc.tcpip/autoconf6 |
|
/etc/rc.tcpip |
IPv6 interfaces |
- Disable unless you are running IP Version 6
|
rc.tcpip/dhcpcd |
|
/etc/rc.tcpip |
Dynamic Host Configure Protocol (client ) |
- Back room servers should not rely on DHCP. Disable this service
- If your host is not using DHCP, disable
|
rc.tcpip/dhcprd |
|
/etc/rc.tcpip |
Dynamic Host Configure Protocol (relay |
- Grabs DHCP broadcasts and sends them to a server on another network
- Duplicate of a service found on routers
- Disable this if you are not using DHCP or rely on passing information
between networks
|
rc.tcpip/dhcpsd |
|
/etc/rc.tcpip |
Dynamic Host Configure Protocol (server |
- Answers DHCP requests from clients at boot time; gives client
information, such as IP name, number, netmask, router, and broadcast
address
- Disable this if you are not using DHCP
- Disabled on production and back room servers along with hosts
not using DHCP
|
rc.tcpip/dpid2 |
|
/etc/rc.tcpip |
outdated SNMP service |
- Disable unless you need SNMP
|
rc.tcpip/gated |
|
/etc.rc.tcpip |
gated routing between interfaces |
- Emulates router function
- Disable this service and use RIP or a router instead
|
rc.tcpip/inetd |
|
/etc/rc.tcpip |
inetd services |
- A thoroughly secured system should have this disabled, but is
often not practical
- Disabling this will disable remote shell services which are required
for some mail and web servers
|
rc.tcpip/mrouted |
|
/etc/rc.tcpip |
multi-cast routing |
- Emulates router function of sending multi-cast packets between
network segments
- Disable this service. Use a router instead
|
rc.tcpip/names |
|
/etc/rc.tcpip |
DNS name server |
- Use this only if your machine is a DNS name server
- Disable for workstation, development and production machines
|
rc.tcpip/ndp-host |
|
/etc/rc.tcpip |
IPv6 host |
- Disable unless you use IP Version 6
|
rc.tcpip/ndp-router |
|
/etc/rc.tcpip |
IPv6 routing |
- Disable this unless you use IP Version 6. Consider using a router
instead of IP Version 6
|
rc.tcpip/portmap |
|
/etc/rc.tcpip |
RPC services |
- Required service
- RPC servers register with portmap daemon. Clients who need
to locate RPC services ask the portmap daemon to tell them
where a particular service is located
- Disable only if you have managed to reduce RPC service so that
the only one remaining is portmap
|
rc.tcpip/routed |
|
/etc/rc.tcpip |
RIP routing between interfaces |
- Emulates router function
- Disable if you have a router for packets between networks
|
rc.tcpip/rwhod |
|
/etc/rc.tcpip |
Remote "who" daemon |
- Collects and broadcasts data to peer servers on the same network
- Disable this service
|
rc.tcpip/sendmail |
|
/etc/rc.tcpip |
mail services |
- Runs as root user
- Disable this service unless the machine is used as a mail server
- If disabled, then do one of the following:
- Place an entry in crontab to clear the queue. Use the /usr/lib/sendmail -q command
- Configure DNS services so that the mail for your server is delivered
to some other system
|
rc.tcpip/snmpd |
|
/etc/rc.tcpip |
Simple Network Management Protocol |
- Disable if you are not monitoring the system via SNMP tools
- SNMP may be required on critical servers
|
rc.tcpip/syslogd |
|
/etc/rc.tcpip |
system log of events |
- Disabling this service is not recommended
- Prone to denial of service attacks
- Required in any system
|
rc.tcpip/timed |
|
/etc/rc.tcpip |
Old Time Daemon |
- Disable this service and use xntp instead
|
rc.tcpip/xntpd |
|
/etc/rc.tcpip |
New Time Daemon |
- Keeps clocks on systems in sync
- Disable this service.
- Configure other systems as time servers and let other systems
synchronize to them with a cron job that calls ntpdate
|
dt login |
|
/usr/dt/config/Xaccess |
unrestricted CDE |
- If you are not providing CDE login to a group of X11 stations,
you can restrict dtlogin to the console.
|
anonymous FTP service |
|
user rmuser -p <username> |
anonymous ftp |
- Anonymous FTP ability prevents you from tracing FTP usage to a
specific user
- Remove user ftp if that user account exists, as follows: rmuser
-p ftp
- Further security can be obtained by populating the /etc/ftpusers file with a list of those who should not be able to ftp to your
system
|
anonymous FTP writes |
|
|
anonymous ftp uploads |
- No file should belong to ftp.
- FTP anonymous uploads allow the potential for misbehaving code
to be placed on your system.
- Put the names of those users you want to disallow into the /etc/ftpusers file
- Some examples of system-created users you might want to disallow
from anonymously uploading via FTP to your system are: root, daemon,
bin.sys, admin.uucp, guest, nobody, lpd, nuucp, ladp
- Change the owner and group rights to the ftpusers files as follows: chown root:system /etc/ftpusers
- Change the permissions to the ftpusers files
to a stricter setting as follows: chmod 644 /etc/ftpusers
|
ftp.restrict |
|
|
ftp to system accounts |
- No user from the outside should be allowed to replace root files
using ftpusers file
|
root.access |
|
/etc/security/user |
rlogin/telnet to root account |
- Set the rlogin option in the etc/security/user file to false
- Anyone logging in as root should first log in under their own
name and then su to root; this provides an audit trail
|
snmpd.readWrite |
|
/etc/snmpd.conf |
SNMP readWrite communities |
- If you are not using SNMP, disable the SNMP daemon.
- Disable community private and community system in the /etc/snmpd.conf file
- Restrict 'public' community to those IP addresses that are monitoring
your system
|
syslog.conf |
|
|
configure syslogd |
- If you have not configured /etc/syslog.conf, then disable this daemon
- If you are using syslog.conf to log system
messages, then keep enabled
|