Default
Y
Description
The
bootpd
daemon implements three functions; a DHCP server, an Internet
Boot Protocol (BOOTP) server, and a DHCP/BOOTP relay agent. If this system
is not a BOOTP/DHCP server or a DHCP/BOOTP relay agent, HP recommends
disabling this service.
Actions
Comment out the entry for
bootp
in the
/etc/inetd.conf
file.
SecureInetd.deactivate_builtin
Headline
Ensure that the
inetd
built-in services do not run on this system.
Default
N
Description
The
inetd
built-in services include
chargen
,
daytime
,
discard
, and
echo
.
These services are rarely used and when they are it is generally for testing.
The UDP versions of these services can be used in a Denial of Service attack
and therefore HP recommends disabling these services.
The
daytime
service sends the current date and time as a human-readable
character string (RFC 867). The
discard
service throws away anything that
is sent to it, similar to
/dev/null
(RFC 863). The
chargen
service character
generator sends a stream of some undefined data, preferably data in some
recognizable pattern (RFC 862). The
echo
service returns the packets sent to
it (RFC 862).
Actions
Comment out the entries for
daytime
,
echo
,
discard
, and
chargen
in the
/etc/inetd.conf
file.
SecureInetd.deactivate_dttools
Headline
Ensure the
inetd
CDE helper services do not run on this system.
Default
N
Description
The
dtspcd
,
ttdbserver
, and
cmsd
services are used by CDE. Each service
has merits, but they are all rarely used and mostly deprecated.
Actions
In the
/etc/inetd.conf
file, comment out the entries for:
•
dtspc stream tcp nowait root /usr/dt/bin/dtspcd
/usr/dt/bin/dtspcd
•
rpc xti tcp swait root /usr/dt/bin/rpc.ttdbserver
100083 1 /usr/dt/bin/rpc.ttdbserver
•
srpc dgram udp wait root /ur/dt/bin/rpc.cmsd 100068
2-5 rpc.cmsd
SecureInetd.deactivate_finger
Headline
Ensure the
inetd finger
service does not run on this system.
Default
Y
Description
The server for the RFC 742 Name/Finger protocol is
fingerd
. It provides a
network interface to
finger
, which gives a status report of users currently
logged in the system or a detailed report about a specific user. For more
information about the finger command, see finger(1). HP recommends disabling
the service because
fingerd
provides local system user information to remote
sources and this can be useful to someone attempting to break into your system.
Actions
In the
/etc/inetd.conf
file, comment out the entry for
finger
.
SecureInetd.deactivate_ftp
Headline
Ensure that the
inetd
FTP service does not run on this system.
Default
N
56
Question modules
