1999-08-27 23:37:10 +00:00
|
|
|
# $FreeBSD$
|
1993-06-20 13:41:45 +00:00
|
|
|
#
|
|
|
|
# Internet server configuration database
|
|
|
|
#
|
Default to disabling all inetd.conf entries, in particular, telnetd
and ftpd. This more conservative default reduces the exposure of
freshly installed machines, which is especially valuable for machines
that receive minimal further configuration before being put into
production. Generally speaking, SSH has superseded the use of both
telnet and ftp in many environments. In light of recent remotely
exploitable security holes in both telnetd and ftpd, this choice
retains flexibility (both telnetd and ftpd daemons remain installed
and easily enableable) while protecting users who don't need the
additional risk. This change brings our configuration into line with
the majority of other UNIX vendors, including OpenBSD and NetBSD.
To address the concerns of those requiring remote access via telnet
from first install, changes will shortly be committed to sysinstall
to provide the ability to edit inetd.conf during the installation
process, allowing telnetd and ftp to be re-enabled during the
installation process.
While I'm at it, slightly improve commenting for inetd.conf so that
it's more clear to users how to enable and disable services.
Further commenting to indicate the functions of various columns would
probably also be useful.
Reviewed by: imp, chris, jake, nate, -arch, -stable
2001-08-02 02:19:56 +00:00
|
|
|
# Define *both* IPv4 and IPv6 entries for dual-stack support.
|
|
|
|
# To disable a service, comment it out by prefixing the line with '#'.
|
|
|
|
# To enable a service, remove the '#' at the beginning of the line.
|
1993-06-20 13:41:45 +00:00
|
|
|
#
|
Default to disabling all inetd.conf entries, in particular, telnetd
and ftpd. This more conservative default reduces the exposure of
freshly installed machines, which is especially valuable for machines
that receive minimal further configuration before being put into
production. Generally speaking, SSH has superseded the use of both
telnet and ftp in many environments. In light of recent remotely
exploitable security holes in both telnetd and ftpd, this choice
retains flexibility (both telnetd and ftpd daemons remain installed
and easily enableable) while protecting users who don't need the
additional risk. This change brings our configuration into line with
the majority of other UNIX vendors, including OpenBSD and NetBSD.
To address the concerns of those requiring remote access via telnet
from first install, changes will shortly be committed to sysinstall
to provide the ability to edit inetd.conf during the installation
process, allowing telnetd and ftp to be re-enabled during the
installation process.
While I'm at it, slightly improve commenting for inetd.conf so that
it's more clear to users how to enable and disable services.
Further commenting to indicate the functions of various columns would
probably also be useful.
Reviewed by: imp, chris, jake, nate, -arch, -stable
2001-08-02 02:19:56 +00:00
|
|
|
#ftp stream tcp nowait root /usr/libexec/ftpd ftpd -l
|
|
|
|
#ftp stream tcp6 nowait root /usr/libexec/ftpd ftpd -l
|
2003-06-09 21:04:30 +00:00
|
|
|
#ssh stream tcp nowait root /usr/sbin/sshd sshd -i -4
|
|
|
|
#ssh stream tcp6 nowait root /usr/sbin/sshd sshd -i -6
|
Default to disabling all inetd.conf entries, in particular, telnetd
and ftpd. This more conservative default reduces the exposure of
freshly installed machines, which is especially valuable for machines
that receive minimal further configuration before being put into
production. Generally speaking, SSH has superseded the use of both
telnet and ftp in many environments. In light of recent remotely
exploitable security holes in both telnetd and ftpd, this choice
retains flexibility (both telnetd and ftpd daemons remain installed
and easily enableable) while protecting users who don't need the
additional risk. This change brings our configuration into line with
the majority of other UNIX vendors, including OpenBSD and NetBSD.
To address the concerns of those requiring remote access via telnet
from first install, changes will shortly be committed to sysinstall
to provide the ability to edit inetd.conf during the installation
process, allowing telnetd and ftp to be re-enabled during the
installation process.
While I'm at it, slightly improve commenting for inetd.conf so that
it's more clear to users how to enable and disable services.
Further commenting to indicate the functions of various columns would
probably also be useful.
Reviewed by: imp, chris, jake, nate, -arch, -stable
2001-08-02 02:19:56 +00:00
|
|
|
#telnet stream tcp nowait root /usr/libexec/telnetd telnetd
|
|
|
|
#telnet stream tcp6 nowait root /usr/libexec/telnetd telnetd
|
2000-10-04 07:56:16 +00:00
|
|
|
#shell stream tcp nowait root /usr/libexec/rshd rshd
|
2001-03-30 10:25:40 +00:00
|
|
|
#shell stream tcp6 nowait root /usr/libexec/rshd rshd
|
2000-10-04 07:56:16 +00:00
|
|
|
#login stream tcp nowait root /usr/libexec/rlogind rlogind
|
2001-03-30 10:25:40 +00:00
|
|
|
#login stream tcp6 nowait root /usr/libexec/rlogind rlogind
|
2000-10-03 00:08:15 +00:00
|
|
|
#finger stream tcp nowait/3/10 nobody /usr/libexec/fingerd fingerd -s
|
2001-03-30 10:25:40 +00:00
|
|
|
#finger stream tcp6 nowait/3/10 nobody /usr/libexec/fingerd fingerd -s
|
1994-09-29 09:20:40 +00:00
|
|
|
#exec stream tcp nowait root /usr/libexec/rexecd rexecd
|
Default to disabling all inetd.conf entries, in particular, telnetd
and ftpd. This more conservative default reduces the exposure of
freshly installed machines, which is especially valuable for machines
that receive minimal further configuration before being put into
production. Generally speaking, SSH has superseded the use of both
telnet and ftp in many environments. In light of recent remotely
exploitable security holes in both telnetd and ftpd, this choice
retains flexibility (both telnetd and ftpd daemons remain installed
and easily enableable) while protecting users who don't need the
additional risk. This change brings our configuration into line with
the majority of other UNIX vendors, including OpenBSD and NetBSD.
To address the concerns of those requiring remote access via telnet
from first install, changes will shortly be committed to sysinstall
to provide the ability to edit inetd.conf during the installation
process, allowing telnetd and ftp to be re-enabled during the
installation process.
While I'm at it, slightly improve commenting for inetd.conf so that
it's more clear to users how to enable and disable services.
Further commenting to indicate the functions of various columns would
probably also be useful.
Reviewed by: imp, chris, jake, nate, -arch, -stable
2001-08-02 02:19:56 +00:00
|
|
|
#
|
1998-12-01 22:01:59 +00:00
|
|
|
# run comsat as root to be able to print partial mailbox contents w/ biff,
|
|
|
|
# or use the safer tty:tty to just print that new mail has been received.
|
Default to disabling all inetd.conf entries, in particular, telnetd
and ftpd. This more conservative default reduces the exposure of
freshly installed machines, which is especially valuable for machines
that receive minimal further configuration before being put into
production. Generally speaking, SSH has superseded the use of both
telnet and ftp in many environments. In light of recent remotely
exploitable security holes in both telnetd and ftpd, this choice
retains flexibility (both telnetd and ftpd daemons remain installed
and easily enableable) while protecting users who don't need the
additional risk. This change brings our configuration into line with
the majority of other UNIX vendors, including OpenBSD and NetBSD.
To address the concerns of those requiring remote access via telnet
from first install, changes will shortly be committed to sysinstall
to provide the ability to edit inetd.conf during the installation
process, allowing telnetd and ftp to be re-enabled during the
installation process.
While I'm at it, slightly improve commenting for inetd.conf so that
it's more clear to users how to enable and disable services.
Further commenting to indicate the functions of various columns would
probably also be useful.
Reviewed by: imp, chris, jake, nate, -arch, -stable
2001-08-02 02:19:56 +00:00
|
|
|
#comsat dgram udp wait tty:tty /usr/libexec/comsat comsat
|
|
|
|
#
|
|
|
|
# ntalk is required for the 'talk' utility to work correctly
|
|
|
|
#ntalk dgram udp wait tty:tty /usr/libexec/ntalkd ntalkd
|
2001-10-22 01:46:53 +00:00
|
|
|
#tftp dgram udp wait root /usr/libexec/tftpd tftpd -s /tftpboot
|
2002-04-11 17:17:28 +00:00
|
|
|
#tftp dgram udp6 wait root /usr/libexec/tftpd tftpd -s /tftpboot
|
1996-10-02 03:52:58 +00:00
|
|
|
#bootps dgram udp wait root /usr/libexec/bootpd bootpd
|
|
|
|
#
|
|
|
|
# "Small servers" -- used to be standard on, but we're more conservative
|
|
|
|
# about things due to Internet security concerns. Only turn on what you
|
|
|
|
# need.
|
|
|
|
#
|
|
|
|
#daytime stream tcp nowait root internal
|
2001-03-30 10:25:40 +00:00
|
|
|
#daytime stream tcp6 nowait root internal
|
1996-10-02 03:52:58 +00:00
|
|
|
#daytime dgram udp wait root internal
|
2001-03-30 10:25:40 +00:00
|
|
|
#daytime dgram udp6 wait root internal
|
1996-10-02 03:52:58 +00:00
|
|
|
#time stream tcp nowait root internal
|
2001-03-30 10:25:40 +00:00
|
|
|
#time stream tcp6 nowait root internal
|
1996-10-02 03:52:58 +00:00
|
|
|
#time dgram udp wait root internal
|
2001-03-30 10:25:40 +00:00
|
|
|
#time dgram udp6 wait root internal
|
1996-10-02 03:52:58 +00:00
|
|
|
#echo stream tcp nowait root internal
|
2001-03-30 10:25:40 +00:00
|
|
|
#echo stream tcp6 nowait root internal
|
2003-06-09 21:04:30 +00:00
|
|
|
#echo dgram udp wait root internal
|
|
|
|
#echo dgram udp6 wait root internal
|
1996-10-02 03:52:58 +00:00
|
|
|
#discard stream tcp nowait root internal
|
2001-03-30 10:25:40 +00:00
|
|
|
#discard stream tcp6 nowait root internal
|
1996-10-02 03:52:58 +00:00
|
|
|
#discard dgram udp wait root internal
|
2001-03-30 10:25:40 +00:00
|
|
|
#discard dgram udp6 wait root internal
|
1996-10-02 03:52:58 +00:00
|
|
|
#chargen stream tcp nowait root internal
|
2001-03-30 10:25:40 +00:00
|
|
|
#chargen stream tcp6 nowait root internal
|
1996-10-02 03:52:58 +00:00
|
|
|
#chargen dgram udp wait root internal
|
2001-03-30 10:25:40 +00:00
|
|
|
#chargen dgram udp6 wait root internal
|
1996-10-02 03:52:58 +00:00
|
|
|
#
|
1999-12-26 15:18:58 +00:00
|
|
|
# CVS servers - for master CVS repositories only! You must set the
|
|
|
|
# --allow-root path correctly or you open a trivial to exploit but
|
|
|
|
# deadly security hole.
|
1996-10-02 03:52:58 +00:00
|
|
|
#
|
1999-12-26 15:18:58 +00:00
|
|
|
#cvspserver stream tcp nowait root /usr/bin/cvs cvs --allow-root=/your/cvsroot/here pserver
|
2002-03-09 04:55:35 +00:00
|
|
|
#cvspserver stream tcp nowait root /usr/bin/cvs cvs --allow-root=/your/cvsroot/here kserver
|
1996-10-02 03:52:58 +00:00
|
|
|
#
|
2002-08-09 17:34:13 +00:00
|
|
|
# RPC based services (you MUST have rpcbind running to use these)
|
1996-10-02 03:52:58 +00:00
|
|
|
#
|
|
|
|
#rstatd/1-3 dgram rpc/udp wait root /usr/libexec/rpc.rstatd rpc.rstatd
|
|
|
|
#rusersd/1-2 dgram rpc/udp wait root /usr/libexec/rpc.rusersd rpc.rusersd
|
|
|
|
#walld/1 dgram rpc/udp wait root /usr/libexec/rpc.rwalld rpc.rwalld
|
|
|
|
#pcnfsd/1-2 dgram rpc/udp wait root /usr/libexec/rpc.pcnfsd rpc.pcnfsd
|
|
|
|
#rquotad/1 dgram rpc/udp wait root /usr/libexec/rpc.rquotad rpc.rquotad
|
|
|
|
#sprayd/1 dgram rpc/udp wait root /usr/libexec/rpc.sprayd rpc.sprayd
|
|
|
|
#
|
|
|
|
# example entry for the optional pop3 server
|
|
|
|
#
|
1994-11-18 20:01:21 +00:00
|
|
|
#pop3 stream tcp nowait root /usr/local/libexec/popper popper
|
1993-12-05 16:39:47 +00:00
|
|
|
#
|
1997-01-12 17:55:16 +00:00
|
|
|
# example entry for the optional imap4 server
|
|
|
|
#
|
|
|
|
#imap4 stream tcp nowait root /usr/local/libexec/imapd imapd
|
|
|
|
#
|
2003-06-06 08:54:29 +00:00
|
|
|
# example entry for the optional nntp server
|
|
|
|
#
|
|
|
|
#nntp stream tcp nowait news /usr/local/libexec/nntpd nntpd
|
|
|
|
#
|
2001-10-01 09:16:42 +00:00
|
|
|
# example entry for the optional uucpd server
|
2003-06-06 08:54:29 +00:00
|
|
|
#
|
2001-10-01 09:16:42 +00:00
|
|
|
#uucpd stream tcp nowait root /usr/local/libexec/uucpd uucpd
|
|
|
|
#
|
1999-07-16 15:41:14 +00:00
|
|
|
# Return error for all "ident" requests
|
1998-11-04 19:42:35 +00:00
|
|
|
#
|
1999-07-16 15:41:14 +00:00
|
|
|
#auth stream tcp nowait root internal
|
2001-03-30 10:25:40 +00:00
|
|
|
#auth stream tcp6 nowait root internal
|
1998-11-04 19:42:35 +00:00
|
|
|
#
|
1999-07-23 15:49:34 +00:00
|
|
|
# Provide internally a real "ident" service which provides ~/.fakeid support,
|
1999-07-24 17:19:54 +00:00
|
|
|
# provides ~/.noident support, reports UNKNOWN as the operating system type
|
|
|
|
# and times out after 30 seconds.
|
1996-10-02 03:52:58 +00:00
|
|
|
#
|
1999-07-24 17:19:54 +00:00
|
|
|
#auth stream tcp nowait root internal auth -r -f -n -o UNKNOWN -t 30
|
2001-03-30 10:25:40 +00:00
|
|
|
#auth stream tcp6 nowait root internal auth -r -f -n -o UNKNOWN -t 30
|
1999-07-16 15:41:14 +00:00
|
|
|
#
|
|
|
|
# Example entry for an external ident server
|
|
|
|
#
|
1999-07-16 16:24:13 +00:00
|
|
|
#auth stream tcp wait root /usr/local/sbin/identd identd -w -t120
|
1997-09-28 22:25:29 +00:00
|
|
|
#
|
2000-01-10 20:02:28 +00:00
|
|
|
# Example entry for the optional qmail MTA
|
|
|
|
# NOTE: This is no longer the correct way to handle incoming SMTP
|
|
|
|
# connections for qmail. Use tcpserver (http://cr.yp.to/ucspi-tcp.html)
|
|
|
|
# instead.
|
1998-07-18 20:01:03 +00:00
|
|
|
#
|
|
|
|
#smtp stream tcp nowait qmaild /var/qmail/bin/tcp-env tcp-env /var/qmail/bin/qmail-smtpd
|
|
|
|
#
|
1997-09-28 22:25:29 +00:00
|
|
|
# Enable the following two entries to enable samba startup from inetd
|
2001-10-03 05:30:56 +00:00
|
|
|
# (from the Samba documentation). Enable the third entry to enable the swat
|
|
|
|
# samba configuration tool.
|
1997-09-28 22:25:29 +00:00
|
|
|
#
|
2001-10-10 17:26:27 +00:00
|
|
|
#netbios-ssn stream tcp nowait root /usr/local/sbin/smbd smbd
|
|
|
|
#netbios-ns dgram udp wait root /usr/local/sbin/nmbd nmbd
|
2002-02-13 08:21:45 +00:00
|
|
|
#swat stream tcp nowait/400 root /usr/local/sbin/swat swat
|
2004-03-08 22:03:29 +00:00
|
|
|
#
|
|
|
|
# Enable the following entry to enable ftp-proxy to NAT ftp sessions with pf
|
2004-03-08 23:18:50 +00:00
|
|
|
# N.B.: inetd binds to * in the default installation so you should add
|
|
|
|
# an appropriate block rule to your pf.conf
|
2004-03-08 22:03:29 +00:00
|
|
|
#
|
|
|
|
#ftp-proxy stream tcp nowait root /usr/local/libexec/ftp-proxy ftp-proxy
|