Re: security risk of having a long list of services in inetd



Paul Dufresne wrote:
2008/8/30 Thomas Weinbrenner <thomas@xxxxxxxxxxxxxxxxxxxxx>:

Well, it is more than just a name. man inetd says:
"inetd should be run at boot time by /etc/rc (see rc(8)). It then listens
for connections on certain internet sockets. When a connection is found
on one of its sockets, it decides what service the socket corresponds to,
and invokes a program to service the request. After the program is fin‐
ished, it continues to listen on the socket (except in some cases which
will be described below). Essentially, inetd allows running one daemon
to invoke several others, reducing load on the system."


The man page also says:
"Upon execution, inetd reads its configuration information from a
configu‐ration file which, by default, is /etc/inetd.conf" :)

As pointed out by martin /etc/services is just an information file, used
by all sorts of programs (netstat, tcpdump etc.) so that they know that,
for eg., the string 'ssh' means TCP port 22.

/etc/inetd.conf is the file you should be looking at as this is inetd's
config file, and controls which ports it will listen on. The default in
Debian, and most other distros, nowadays is for it not to listen on any
ports - you have to configure what services you want.

When there is so much, it become too hard to look at each door to see
if there is a program behind, and if it does what it should.
"netstat -plunt" will show you exactly which programs are listening on
which port.
Thanks, I tend to use 'lsof -i4' but I believe your command is better for that.
If I was to exploit a security vulnerability (never did, nor want to)
and become root on your computer, I would prefer to abuse one of the
service in /etc/services rather than have a program sitting there to
listen to the Internet. That way, you would have to do the 'netstat
-plunt' command, while I am sending commands to your computer to
discover me.

But if there's no program sitting there listening on the port there's
nothing to connect to and nothing to abuse. You'll simply get a 'port
unreachable' (or something similar) ICMP message back from the kernel.
Unless the kernel itself has a security hole of course, which is why
running apt-get upgrade regularly is a good idea :)


--
To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx
with a subject of "unsubscribe". Trouble? Contact listmaster@xxxxxxxxxxxxxxxx

Relevant Pages

  • Re: Difficulty opening a socket
    ... Is there something listening on port 8080 on your local machine. ... Sockets are ...
    (comp.lang.ruby)
  • listening socket alive even after process death ?
    ... 37708 on host host#1. ... Sockets seem to be all alive on the other end although listening ... Moreover I can even connect to host#1 on the same port with telnet. ...
    (comp.os.linux.networking)
  • Re: Port 20715
    ... That's a high end port, usually client side sockets use that but some ... See if you have it listening, ...
    (comp.security.firewalls)
  • Re: Best Plan of action for 2 forest.......
    ... PortQry reports the status of a port in one of the following ways: ... ..LISTENING This response indicates that a process is listening on the target ...
    (microsoft.public.windows.server.active_directory)
  • Re: RealVNC
    ... If we are talking about RealVNC it goes this way ... Then there is default Java listening port on port 5800 on the client machine ...
    (microsoft.public.windows.server.sbs)