d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
9096f97fa1
freebsd-nq/etc/inetd.conf

125 lines
4.6 KiB
Plaintext
Raw Normal View History

$Id$ -> $FreeBSD$
1999-08-27 23:37:10 +00:00
# $FreeBSD$
Initial import of 386BSD 0.1 othersrc/etc
1993-06-20 13:41:45 +00:00
#
# Internet server configuration database
#
# @(#)inetd.conf 5.4 (Berkeley) 6/30/90
#
ftp stream tcp nowait root /usr/libexec/ftpd ftpd -l
telnet stream tcp nowait root /usr/libexec/telnetd telnetd
shell stream tcp nowait root /usr/libexec/rshd rshd
login stream tcp nowait root /usr/libexec/rlogind rlogind
Limit the fingerd daemon to: runs only 3 simultaneous fingerd processes and limit the connections-per-ip-per-minute to 10.
1998-09-30 16:12:40 +00:00
finger stream tcp nowait/3/10 nobody /usr/libexec/fingerd fingerd -s
Disable rexecd by default (major security hole)
1994-09-29 09:20:40 +00:00
#exec stream tcp nowait root /usr/libexec/rexecd rexecd
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 03:52:58 +00:00
#uucpd stream tcp nowait root /usr/libexec/uucpd uucpd
Initial import of 386BSD 0.1 othersrc/etc
1993-06-20 13:41:45 +00:00
#nntp stream tcp nowait usenet /usr/libexec/nntpd nntpd
comsat sandbox prevents biff/comsat from being able to print partial mailbox contents. comsat instead simply prints that new mail is available. Add appropriate comment to inetd.conf but leave comsat in sandbox.
1998-12-01 22:01:59 +00:00
# run comsat as root to be able to print partial mailbox contents w/ biff,
# or use the safer tty:tty to just print that new mail has been received.
Added group bind(53), added sandbox users tty(4), kmem(5), and bind(53), adjustd inetd.conf to run comsat and ntalk from tty sandbox, and the (commented out) ident from the kmem sandbox. Note that it is necessary to give each group access it's own uid to prevent programs running under a single uid from being able to gdb or otherwise mess with other programs (with different group perms) running under the same uid.
1998-12-01 21:19:49 +00:00
comsat dgram udp wait tty:tty /usr/libexec/comsat comsat
ntalk dgram udp wait tty:tty /usr/libexec/ntalkd ntalkd
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 03:52:58 +00:00
#tftp dgram udp wait nobody /usr/libexec/tftpd tftpd /tftpboot
#bootps dgram udp wait root /usr/libexec/bootpd bootpd
#
# "Small servers" -- used to be standard on, but we're more conservative
# about things due to Internet security concerns. Only turn on what you
# need.
#
#daytime stream tcp nowait root internal
#daytime dgram udp wait root internal
#time stream tcp nowait root internal
#time dgram udp wait root internal
#echo stream tcp nowait root internal
Disable UDP echo, chargen, date, and daytime services.
1994-12-21 20:32:44 +00:00
#echo dgram udp wait root internal
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 03:52:58 +00:00
#discard stream tcp nowait root internal
#discard dgram udp wait root internal
#chargen stream tcp nowait root internal
#chargen dgram udp wait root internal
#
Initial import of 386BSD 0.1 othersrc/etc
1993-06-20 13:41:45 +00:00
# Kerberos authenticated services
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 03:52:58 +00:00
#
The kerberised network services should only be active in inetd.conf if kerberos is installed. So far as I'm aware, kerberos aware clients detect ECONNREFUSED and (if allowed) fall back to the non-kerberos servers. They do not know how to interpret messages such as "rlogind: unknown option -k". I believe Garrett also mentioned this. Unfortunately, this adds an extra step to bringing up kerberos. It also stops /var/log/messages getting quite so many useless (and confusing) error messages when somebody does a port scan on you.
1996-11-10 13:06:14 +00:00
#klogin stream tcp nowait root /usr/libexec/rlogind rlogind -k
#eklogin stream tcp nowait root /usr/libexec/rlogind rlogind -k -x
#kshell stream tcp nowait root /usr/libexec/rshd rshd -k
Clean up the kerberos entries, and add example CVS entries
1998-08-15 17:32:27 +00:00
#kip stream tcp nowait root /usr/libexec/kipd kipd
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 03:52:58 +00:00
#
Update the cvs pserver example so that it gives some more obvious clues about the --allow-root switch. PR: 14463
1999-12-26 15:18:58 +00:00
# CVS servers - for master CVS repositories only! You must set the
# --allow-root path correctly or you open a trivial to exploit but
# deadly security hole.
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 03:52:58 +00:00
#
Update the cvs pserver example so that it gives some more obvious clues about the --allow-root switch. PR: 14463
1999-12-26 15:18:58 +00:00
#cvspserver stream tcp nowait root /usr/bin/cvs cvs --allow-root=/your/cvsroot/here pserver
#cvs stream tcp nowait root /usr/bin/cvs cvs --allow-root=/your/cvsroot/here kserver
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 03:52:58 +00:00
#
# RPC based services (you MUST have portmapper running to use these)
#
#rstatd/1-3 dgram rpc/udp wait root /usr/libexec/rpc.rstatd rpc.rstatd
#rusersd/1-2 dgram rpc/udp wait root /usr/libexec/rpc.rusersd rpc.rusersd
#walld/1 dgram rpc/udp wait root /usr/libexec/rpc.rwalld rpc.rwalld
#pcnfsd/1-2 dgram rpc/udp wait root /usr/libexec/rpc.pcnfsd rpc.pcnfsd
#rquotad/1 dgram rpc/udp wait root /usr/libexec/rpc.rquotad rpc.rquotad
#sprayd/1 dgram rpc/udp wait root /usr/libexec/rpc.sprayd rpc.sprayd
#
# example entry for the optional pop3 server
#
Change the example line for popper to point to /usr/local/libexec/popper instead of /usr/local/etc/popper. The 2.0 installation installs it there.
1994-11-18 20:01:21 +00:00
#pop3 stream tcp nowait root /usr/local/libexec/popper popper
Added entries for sup into services. Added an example entry for the pop3 popper into inetd.conf as a comment.
1993-12-05 16:39:47 +00:00
#
Add commented out example entry for imap4
1997-01-12 17:55:16 +00:00
# example entry for the optional imap4 server
#
#imap4 stream tcp nowait root /usr/local/libexec/imapd imapd
#
Document the new {auth,ident,tap} service and provide examples in the configuration file. Requested by: green
1999-07-16 15:41:14 +00:00
# Return error for all "ident" requests
Add example for the internal "ident server".
1998-11-04 19:42:35 +00:00
#
Document the new {auth,ident,tap} service and provide examples in the configuration file. Requested by: green
1999-07-16 15:41:14 +00:00
#auth stream tcp nowait root internal
Add example for the internal "ident server".
1998-11-04 19:42:35 +00:00
#
Document the -o and -t options to the internal auth service and give an example of their usage in the sample config. Merge the two examples for the green internal auth service. This commit failed the first time around because Brian beat me to the punch on inetd.8 . I like my descriptions better and I'm pretty sure Brian won't mind.
1999-07-23 15:49:34 +00:00
# Provide internally a real "ident" service which provides ~/.fakeid support,
Add -n to the example and explanation of the internal auth service.
1999-07-24 17:19:54 +00:00
# provides ~/.noident support, reports UNKNOWN as the operating system type
# and times out after 30 seconds.
In the brave new world, that that does not make us strong, kills us. Turn OFF the "small servers" by default. FreeBSD systems should only serve actively used programs. Jewels like chargen and echo are too useful in attack scenarios.
1996-10-02 03:52:58 +00:00
#
Add -n to the example and explanation of the internal auth service.
1999-07-24 17:19:54 +00:00
#auth stream tcp nowait root internal auth -r -f -n -o UNKNOWN -t 30
Document the new {auth,ident,tap} service and provide examples in the configuration file. Requested by: green
1999-07-16 15:41:14 +00:00
#
# Example entry for an external ident server
#
I think the last revision got lost here. Identd needs to be run as root, at least for now. I relegated the getcred sysctls to only root, but if they're deemed to be "allowable" to export to users, I'll do so and revert this change.
1999-07-16 16:24:13 +00:00
#auth stream tcp wait root /usr/local/sbin/identd identd -w -t120
Restore the Samba entries which were spammed when someone added the imap4 entry.
1997-09-28 22:25:29 +00:00
#
Include a note below the example qmail entry that mentions that inetd is no longer the correct way to have qmail handle incoming qmail smtp connections. Also provide a url to the correct method.
2000-01-10 20:02:28 +00:00
# Example entry for the optional qmail MTA
# NOTE: This is no longer the correct way to handle incoming SMTP
# connections for qmail. Use tcpserver (http://cr.yp.to/ucspi-tcp.html)
# instead.
MFC: sample qmail entry.
1998-07-18 20:01:03 +00:00
#
#smtp stream tcp nowait qmaild /var/qmail/bin/tcp-env tcp-env /var/qmail/bin/qmail-smtpd
#
Restore the Samba entries which were spammed when someone added the imap4 entry.
1997-09-28 22:25:29 +00:00
# Enable the following two entries to enable samba startup from inetd
# (from the Samba documentation).
#
#netbios-ssn stream tcp nowait root /usr/local/sbin/smbd smbd
#netbios-ns dgram udp wait root /usr/local/sbin/nmbd nmbd
Add IPv6 services into inetd.conf. Also enable some standard IPv6 apps by default. These entries will be simply ignored on systems with no INET6 defined. Approved by: jkh Suggested by: peter
2000-02-27 18:39:34 +00:00
#
# IPv6 services
#
ftp stream tcp6 nowait root /usr/libexec/ftpd ftpd -l
telnet stream tcp6 nowait root /usr/libexec/telnetd telnetd
shell stream tcp6 nowait root /usr/libexec/rshd rshd
login stream tcp6 nowait root /usr/libexec/rlogind rlogind
finger stream tcp6 nowait/3/10 nobody /usr/libexec/fingerd fingerd -s
#
# IPv6 "Small servers"
#
#daytime stream tcp6 nowait root internal
#daytime dgram udp6 wait root internal
#time stream tcp6 nowait root internal
#time dgram udp6 wait root internal
#echo stream tcp6 nowait root internal
#echo dgram udp6 wait root internal
#discard stream tcp6 nowait root internal
#discard dgram udp6 wait root internal
#chargen stream tcp6 nowait root internal
#chargen dgram udp6 wait root internal
#
# IPv6 ident service
#
#auth stream tcp6 nowait root internal
#
Fix a typo. (s/eExample/Example/) Submitted by: Robert Muir <rmuir@looksharp.net>
2000-03-05 20:23:44 +00:00
# An Example for IPv6 indent service
Add IPv6 services into inetd.conf. Also enable some standard IPv6 apps by default. These entries will be simply ignored on systems with no INET6 defined. Approved by: jkh Suggested by: peter
2000-02-27 18:39:34 +00:00
#
#auth stream tcp6 nowait root internal auth -r -f -n -o UNKNOWN -t 30
Reference in New Issue Copy Permalink