Default to disabling all inetd.conf entries, in particular, telnetd
and ftpd. This more conservative default reduces the exposure of freshly installed machines, which is especially valuable for machines that receive minimal further configuration before being put into production. Generally speaking, SSH has superseded the use of both telnet and ftp in many environments. In light of recent remotely exploitable security holes in both telnetd and ftpd, this choice retains flexibility (both telnetd and ftpd daemons remain installed and easily enableable) while protecting users who don't need the additional risk. This change brings our configuration into line with the majority of other UNIX vendors, including OpenBSD and NetBSD. To address the concerns of those requiring remote access via telnet from first install, changes will shortly be committed to sysinstall to provide the ability to edit inetd.conf during the installation process, allowing telnetd and ftp to be re-enabled during the installation process. While I'm at it, slightly improve commenting for inetd.conf so that it's more clear to users how to enable and disable services. Further commenting to indicate the functions of various columns would probably also be useful. Reviewed by: imp, chris, jake, nate, -arch, -stable
This commit is contained in:
parent
d51456f800
commit
f2419a7154
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=81020
@ -2,12 +2,14 @@
|
|||||||
#
|
#
|
||||||
# Internet server configuration database
|
# Internet server configuration database
|
||||||
#
|
#
|
||||||
# define *both* IPv4 and IPv6 entries for dual-stack support.
|
# Define *both* IPv4 and IPv6 entries for dual-stack support.
|
||||||
|
# To disable a service, comment it out by prefixing the line with '#'.
|
||||||
|
# To enable a service, remove the '#' at the beginning of the line.
|
||||||
#
|
#
|
||||||
ftp stream tcp nowait root /usr/libexec/ftpd ftpd -l
|
#ftp stream tcp nowait root /usr/libexec/ftpd ftpd -l
|
||||||
ftp stream tcp6 nowait root /usr/libexec/ftpd ftpd -l
|
#ftp stream tcp6 nowait root /usr/libexec/ftpd ftpd -l
|
||||||
telnet stream tcp nowait root /usr/libexec/telnetd telnetd
|
#telnet stream tcp nowait root /usr/libexec/telnetd telnetd
|
||||||
telnet stream tcp6 nowait root /usr/libexec/telnetd telnetd
|
#telnet stream tcp6 nowait root /usr/libexec/telnetd telnetd
|
||||||
#shell stream tcp nowait root /usr/libexec/rshd rshd
|
#shell stream tcp nowait root /usr/libexec/rshd rshd
|
||||||
#shell stream tcp6 nowait root /usr/libexec/rshd rshd
|
#shell stream tcp6 nowait root /usr/libexec/rshd rshd
|
||||||
#login stream tcp nowait root /usr/libexec/rlogind rlogind
|
#login stream tcp nowait root /usr/libexec/rlogind rlogind
|
||||||
@ -17,10 +19,13 @@ telnet stream tcp6 nowait root /usr/libexec/telnetd telnetd
|
|||||||
#exec stream tcp nowait root /usr/libexec/rexecd rexecd
|
#exec stream tcp nowait root /usr/libexec/rexecd rexecd
|
||||||
#uucpd stream tcp nowait root /usr/libexec/uucpd uucpd
|
#uucpd stream tcp nowait root /usr/libexec/uucpd uucpd
|
||||||
#nntp stream tcp nowait usenet /usr/libexec/nntpd nntpd
|
#nntp stream tcp nowait usenet /usr/libexec/nntpd nntpd
|
||||||
|
#
|
||||||
# run comsat as root to be able to print partial mailbox contents w/ biff,
|
# run comsat as root to be able to print partial mailbox contents w/ biff,
|
||||||
# or use the safer tty:tty to just print that new mail has been received.
|
# or use the safer tty:tty to just print that new mail has been received.
|
||||||
comsat dgram udp wait tty:tty /usr/libexec/comsat comsat
|
#comsat dgram udp wait tty:tty /usr/libexec/comsat comsat
|
||||||
ntalk dgram udp wait tty:tty /usr/libexec/ntalkd ntalkd
|
#
|
||||||
|
# ntalk is required for the 'talk' utility to work correctly
|
||||||
|
#ntalk dgram udp wait tty:tty /usr/libexec/ntalkd ntalkd
|
||||||
#tftp dgram udp wait nobody /usr/libexec/tftpd tftpd /tftpboot
|
#tftp dgram udp wait nobody /usr/libexec/tftpd tftpd /tftpboot
|
||||||
#bootps dgram udp wait root /usr/libexec/bootpd bootpd
|
#bootps dgram udp wait root /usr/libexec/bootpd bootpd
|
||||||
#
|
#
|
||||||
|
Loading…
Reference in New Issue
Block a user