hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-12-28 14:24:09 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity
0d86878ce0
HardenedBSD/etc/inetd.conf

72 lines
2.8 KiB
Plaintext
Raw Normal View History

Initial import of 386BSD 0.1 othersrc/etc
1993-06-20 15:41:45 +02:00
#
# Internet server configuration database
#
# @(#)inetd.conf 5.4 (Berkeley) 6/30/90
#
ftp stream tcp nowait root /usr/libexec/ftpd ftpd -l
telnet stream tcp nowait root /usr/libexec/telnetd telnetd
shell stream tcp nowait root /usr/libexec/rshd rshd
login stream tcp nowait root /usr/libexec/rlogind rlogind
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 05:52:58 +02:00
finger stream tcp nowait nobody /usr/libexec/fingerd fingerd -s
Disable rexecd by default (major security hole)
1994-09-29 10:20:40 +01:00
#exec stream tcp nowait root /usr/libexec/rexecd rexecd
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 05:52:58 +02:00
#uucpd stream tcp nowait root /usr/libexec/uucpd uucpd
Initial import of 386BSD 0.1 othersrc/etc
1993-06-20 15:41:45 +02:00
#nntp stream tcp nowait usenet /usr/libexec/nntpd nntpd
comsat dgram udp wait root /usr/libexec/comsat comsat
ntalk dgram udp wait root /usr/libexec/ntalkd ntalkd
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 05:52:58 +02:00
#tftp dgram udp wait nobody /usr/libexec/tftpd tftpd /tftpboot
#bootps dgram udp wait root /usr/libexec/bootpd bootpd
#
# "Small servers" -- used to be standard on, but we're more conservative
# about things due to Internet security concerns. Only turn on what you
# need.
#
#daytime stream tcp nowait root internal
#daytime dgram udp wait root internal
#time stream tcp nowait root internal
#time dgram udp wait root internal
#echo stream tcp nowait root internal
Disable UDP echo, chargen, date, and daytime services.
1994-12-21 21:32:44 +01:00
#echo dgram udp wait root internal
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 05:52:58 +02:00
#discard stream tcp nowait root internal
#discard dgram udp wait root internal
#chargen stream tcp nowait root internal
#chargen dgram udp wait root internal
#
Initial import of 386BSD 0.1 othersrc/etc
1993-06-20 15:41:45 +02:00
# Kerberos authenticated services
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 05:52:58 +02:00
#
The kerberised network services should only be active in inetd.conf if kerberos is installed. So far as I'm aware, kerberos aware clients detect ECONNREFUSED and (if allowed) fall back to the non-kerberos servers. They do not know how to interpret messages such as "rlogind: unknown option -k". I believe Garrett also mentioned this. Unfortunately, this adds an extra step to bringing up kerberos. It also stops /var/log/messages getting quite so many useless (and confusing) error messages when somebody does a port scan on you.
1996-11-10 14:06:14 +01:00
#klogin stream tcp nowait root /usr/libexec/rlogind rlogind -k
#eklogin stream tcp nowait root /usr/libexec/rlogind rlogind -k -x
#kshell stream tcp nowait root /usr/libexec/rshd rshd -k
#rkinit stream tcp nowait root /usr/libexec/rkinitd rkinitd
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 05:52:58 +02:00
#
Initial import of 386BSD 0.1 othersrc/etc
1993-06-20 15:41:45 +02:00
# Services run ONLY on the Kerberos server
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 05:52:58 +02:00
#
Initial import of 386BSD 0.1 othersrc/etc
1993-06-20 15:41:45 +02:00
#krbupdate stream tcp nowait root /usr/libexec/registerd registerd
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 05:52:58 +02:00
#kpasswd stream tcp nowait root /usr/libexec/kpasswdd kpasswdd
#
# RPC based services (you MUST have portmapper running to use these)
#
#rstatd/1-3 dgram rpc/udp wait root /usr/libexec/rpc.rstatd rpc.rstatd
#rusersd/1-2 dgram rpc/udp wait root /usr/libexec/rpc.rusersd rpc.rusersd
#walld/1 dgram rpc/udp wait root /usr/libexec/rpc.rwalld rpc.rwalld
#pcnfsd/1-2 dgram rpc/udp wait root /usr/libexec/rpc.pcnfsd rpc.pcnfsd
#rquotad/1 dgram rpc/udp wait root /usr/libexec/rpc.rquotad rpc.rquotad
#sprayd/1 dgram rpc/udp wait root /usr/libexec/rpc.sprayd rpc.sprayd
#
# example entry for the optional pop3 server
#
Change the example line for popper to point to /usr/local/libexec/popper instead of /usr/local/etc/popper. The 2.0 installation installs it there.
1994-11-18 21:01:21 +01:00
#pop3 stream tcp nowait root /usr/local/libexec/popper popper
Added entries for sup into services. Added an example entry for the pop3 popper into inetd.conf as a comment.
1993-12-05 17:39:47 +01:00
#
Add commented out example entry for imap4
1997-01-12 18:55:16 +01:00
# example entry for the optional imap4 server
#
#imap4 stream tcp nowait root /usr/local/libexec/imapd imapd
#
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 05:52:58 +02:00
# example entry for the optional ident server
#
#ident stream tcp wait root /usr/local/sbin/identd identd -w -t120
Restore the Samba entries which were spammed when someone added the imap4 entry.
1997-09-29 00:25:29 +02:00
#
# Enable the following two entries to enable samba startup from inetd
# (from the Samba documentation).
#
#netbios-ssn stream tcp nowait root /usr/local/sbin/smbd smbd
#netbios-ns dgram udp wait root /usr/local/sbin/nmbd nmbd
Reference in New Issue Copy Permalink