d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
3307604ff5
freebsd-dev/etc/inetd.conf

83 lines
3.2 KiB
Plaintext
Raw Normal View History

comsat sandbox prevents biff/comsat from being able to print partial mailbox contents. comsat instead simply prints that new mail is available. Add appropriate comment to inetd.conf but leave comsat in sandbox.
1998-12-01 22:01:59 +00:00
# $Id: inetd.conf,v 1.32 1998/12/01 21:19:49 dillon Exp $
Initial import of 386BSD 0.1 othersrc/etc
1993-06-20 13:41:45 +00:00
#
# Internet server configuration database
#
# @(#)inetd.conf 5.4 (Berkeley) 6/30/90
#
ftp stream tcp nowait root /usr/libexec/ftpd ftpd -l
telnet stream tcp nowait root /usr/libexec/telnetd telnetd
shell stream tcp nowait root /usr/libexec/rshd rshd
login stream tcp nowait root /usr/libexec/rlogind rlogind
Limit the fingerd daemon to: runs only 3 simultaneous fingerd processes and limit the connections-per-ip-per-minute to 10.
1998-09-30 16:12:40 +00:00
finger stream tcp nowait/3/10 nobody /usr/libexec/fingerd fingerd -s
Disable rexecd by default (major security hole)
1994-09-29 09:20:40 +00:00
#exec stream tcp nowait root /usr/libexec/rexecd rexecd
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 03:52:58 +00:00
#uucpd stream tcp nowait root /usr/libexec/uucpd uucpd
Initial import of 386BSD 0.1 othersrc/etc
1993-06-20 13:41:45 +00:00
#nntp stream tcp nowait usenet /usr/libexec/nntpd nntpd
comsat sandbox prevents biff/comsat from being able to print partial mailbox contents. comsat instead simply prints that new mail is available. Add appropriate comment to inetd.conf but leave comsat in sandbox.
1998-12-01 22:01:59 +00:00
# run comsat as root to be able to print partial mailbox contents w/ biff,
# or use the safer tty:tty to just print that new mail has been received.
Added group bind(53), added sandbox users tty(4), kmem(5), and bind(53), adjustd inetd.conf to run comsat and ntalk from tty sandbox, and the (commented out) ident from the kmem sandbox. Note that it is necessary to give each group access it's own uid to prevent programs running under a single uid from being able to gdb or otherwise mess with other programs (with different group perms) running under the same uid.
1998-12-01 21:19:49 +00:00
comsat dgram udp wait tty:tty /usr/libexec/comsat comsat
ntalk dgram udp wait tty:tty /usr/libexec/ntalkd ntalkd
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 03:52:58 +00:00
#tftp dgram udp wait nobody /usr/libexec/tftpd tftpd /tftpboot
#bootps dgram udp wait root /usr/libexec/bootpd bootpd
#
# "Small servers" -- used to be standard on, but we're more conservative
# about things due to Internet security concerns. Only turn on what you
# need.
#
#daytime stream tcp nowait root internal
#daytime dgram udp wait root internal
#time stream tcp nowait root internal
#time dgram udp wait root internal
#echo stream tcp nowait root internal
Disable UDP echo, chargen, date, and daytime services.
1994-12-21 20:32:44 +00:00
#echo dgram udp wait root internal
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 03:52:58 +00:00
#discard stream tcp nowait root internal
#discard dgram udp wait root internal
#chargen stream tcp nowait root internal
#chargen dgram udp wait root internal
#
Initial import of 386BSD 0.1 othersrc/etc
1993-06-20 13:41:45 +00:00
# Kerberos authenticated services
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 03:52:58 +00:00
#
The kerberised network services should only be active in inetd.conf if kerberos is installed. So far as I'm aware, kerberos aware clients detect ECONNREFUSED and (if allowed) fall back to the non-kerberos servers. They do not know how to interpret messages such as "rlogind: unknown option -k". I believe Garrett also mentioned this. Unfortunately, this adds an extra step to bringing up kerberos. It also stops /var/log/messages getting quite so many useless (and confusing) error messages when somebody does a port scan on you.
1996-11-10 13:06:14 +00:00
#klogin stream tcp nowait root /usr/libexec/rlogind rlogind -k
#eklogin stream tcp nowait root /usr/libexec/rlogind rlogind -k -x
#kshell stream tcp nowait root /usr/libexec/rshd rshd -k
Clean up the kerberos entries, and add example CVS entries
1998-08-15 17:32:27 +00:00
#kip stream tcp nowait root /usr/libexec/kipd kipd
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 03:52:58 +00:00
#
Clean up the kerberos entries, and add example CVS entries
1998-08-15 17:32:27 +00:00
# CVS servers - for master CVS repositories only!
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 03:52:58 +00:00
#
Clean up the kerberos entries, and add example CVS entries
1998-08-15 17:32:27 +00:00
#cvspserver stream tcp nowait root /usr/bin/cvs cvs pserver
#cvs stream tcp nowait root /usr/bin/cvs cvs kserver
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 03:52:58 +00:00
#
# RPC based services (you MUST have portmapper running to use these)
#
#rstatd/1-3 dgram rpc/udp wait root /usr/libexec/rpc.rstatd rpc.rstatd
#rusersd/1-2 dgram rpc/udp wait root /usr/libexec/rpc.rusersd rpc.rusersd
#walld/1 dgram rpc/udp wait root /usr/libexec/rpc.rwalld rpc.rwalld
#pcnfsd/1-2 dgram rpc/udp wait root /usr/libexec/rpc.pcnfsd rpc.pcnfsd
#rquotad/1 dgram rpc/udp wait root /usr/libexec/rpc.rquotad rpc.rquotad
#sprayd/1 dgram rpc/udp wait root /usr/libexec/rpc.sprayd rpc.sprayd
#
# example entry for the optional pop3 server
#
Change the example line for popper to point to /usr/local/libexec/popper instead of /usr/local/etc/popper. The 2.0 installation installs it there.
1994-11-18 20:01:21 +00:00
#pop3 stream tcp nowait root /usr/local/libexec/popper popper
Added entries for sup into services. Added an example entry for the pop3 popper into inetd.conf as a comment.
1993-12-05 16:39:47 +00:00
#
Add commented out example entry for imap4
1997-01-12 17:55:16 +00:00
# example entry for the optional imap4 server
#
#imap4 stream tcp nowait root /usr/local/libexec/imapd imapd
#
Add example for the internal "ident server".
1998-11-04 19:42:35 +00:00
# Return error for all "ident" requests
#
#ident stream tcp nowait root internal
#
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 03:52:58 +00:00
# example entry for the optional ident server
#
Added group bind(53), added sandbox users tty(4), kmem(5), and bind(53), adjustd inetd.conf to run comsat and ntalk from tty sandbox, and the (commented out) ident from the kmem sandbox. Note that it is necessary to give each group access it's own uid to prevent programs running under a single uid from being able to gdb or otherwise mess with other programs (with different group perms) running under the same uid.
1998-12-01 21:19:49 +00:00
#ident stream tcp wait kmem:kmem /usr/local/sbin/identd identd -w -t120
Restore the Samba entries which were spammed when someone added the imap4 entry.
1997-09-28 22:25:29 +00:00
#
MFC: sample qmail entry.
1998-07-18 20:01:03 +00:00
# example entry for the optional qmail MTA
#
#smtp stream tcp nowait qmaild /var/qmail/bin/tcp-env tcp-env /var/qmail/bin/qmail-smtpd
#
Restore the Samba entries which were spammed when someone added the imap4 entry.
1997-09-28 22:25:29 +00:00
# Enable the following two entries to enable samba startup from inetd
# (from the Samba documentation).
#
#netbios-ssn stream tcp nowait root /usr/local/sbin/smbd smbd
#netbios-ns dgram udp wait root /usr/local/sbin/nmbd nmbd
Reference in New Issue Copy Permalink