Unwanted inetd Services
A user asked: "About security... Can PIKT check if unwanted inetd services like finger, walld, rusersd are closed?"
Although we have removed it from the configs_samples in order to preserve our privacy/security, we manage our inetd.conf in the file =piktdir/lib/configs/files/inetd_conf_files.cfg. By commenting out the finger, walld, rusersd, etc. lines with '//, or by prepending such lines with '#', it is very easy for us to enforce consistent access policies across our systems.
So, for example, here are some relevant portions of our configuration:
// under development #ifndef generic // only solaris is finished, so the following #if has us bypass the others # if solaris # include <files/inetd_conf_files.cfg> # endif #include <files/hosts_allow_files.cfg> #include <files/hosts_deny_files.cfg> #endifdef // generic
... #finger stream tcp nowait nobody /usr/sbin/in.fingerd in.fingerd ... #rusersd/2-3 tli rpc/datagram_v,circuit_v wait root /usr/lib/netsvc/rusers/rpc.rusersd rpc.rusersd ... # if ! cssys | comp | perf | madrid // multi-user systems walld/1 tli rpc/datagram_v wait root /usr/lib/netsvc/rwall/ rpc.rwalld rpc.rwalld # else #walld/1 tli rpc/datagram_v wait root /usr/lib/netsvc/rwall/rpc.rwalld rpc.rwalld # endif
We install inetd.conf files with:
# piktc -iv +F inetd.conf +H solaris
and restart inetd with
# piktc -xv +S SigHupInetd +H solaris
Nightly, we run the PiktcDiffChkWarning to verify that the distributed PIKT-managed files, including inetd.conf, do not diverge from the central configuration.
Another possibility would be to write a new alarm script to scan the inetd.conf files regularly, sending out alert mail if it finds any of the troublesome services uncommented. Something like:
if $inline =~ "^(finger|rusersd|walld)" output mail "COMMENT THIS OUT: $inline" fi
I'm sure that there are other good solutions to this unwanted inetd services problem as well.
For more examples, see Developer's Notes.