Improve Linux security

The results are also shown in Figure B. You'll notice that they are significantly different from the results shown in Figure A. Unlike in inetd, this command will not show you which services xinetd is listening for. To see those services, you must list the files in the /etc/xinetd.d directory, which is the equivalent of the /etc/inetd.d directory used by inetd. To do so, enter the command:ls -l /etc/xinetd.d/*
Figure C
The results, shown in Figure C, indicate which services xinetd is listening for. To turn off a service you don't want xinetd to run, you need to edit the file for that particular service. For example, to turn off talk, you would edit the /etc/xinetd.d/talk file using vi or another text editor, so that disable equals yes, as shown in Figure D. Note that you will need to restart xinetd for any configuration changes to take effect.
Figure D
Services not run by the inetd or xinetd daemons
While the configuration files of the inetd and xinetd daemons are useful in determining which network services have been started by these super daemons, not all network services are or should be under their control. Increasingly, network services are being configured to start independently at system startup. Their startup scripts can be found in the /etc/rc.d directory. To access this directory and view a listing, open a terminal window and enter the following commands:cd /etc/rc.dls -l rc*.d
Figure E
As Figure E shows, the /etc/rc.d directory contains seven subdirectories of start scripts that are invoked by the init process as the system enters the designated runlevel. For example, upon startup, a Red Hat workstation installed with X-Windows defaults to runlevel 5; init looks in the /etc/rc.d/rc5.d directory and runs each start script it finds listed there. If you press [Ctrl][Alt][F1] as root, you will be returned to the text-based login screen, or runlevel 3, at which level init will run the scripts found in rc3.d. To identify the scripts that will run under a particular runlevel, such as 3, enter the following command:cd rc3.dls -l
Figure F
Note that the partial listing of rc3.d shown in Figure F does not contain the actual scripts themselves, but symbolic links to them which are located in the /etc/r.d/init.d directory. As with stand-alone systems connected to the Internet, the ps command should be executed upon booting your system to see which daemons have actually been started. (Note that even though a script is supposed to run at a particular runlevel, it may not if the script requires a certain configuration that doesn't exist on your system.) If you don't want a specific service to run, you must find and delete the link to its start script from its corresponding /etc/rc*.d directory. Many Linux distributions include graphical system tools (e.g., Linuxconf or YaST) that can be used to stop unnecessary services without having to delete the scripts manually. Determine what's running now
After you have made changes to the inedt or xinedt configuration files and the rc.d directories, how can you be sure all unnecessary network services have been stopped? It is a good idea to run the netstat utility any time changes are made to the configuration files and upon reboot. To find out which ports are currently awaiting connections, enter netstat with the --inet and -a options, as shown in Figure G.
Figure G
Only by examining the output from the netstat command can you be sure that the changes you made have taken effect and that your system ports are not open to active services.
Have your say instantly in the
Tech Update forum. Find out what's where in the new Tech Update with our
Guided Tour. Let the editors know what you think in the
Mailroom.

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

  • Login

Will not be displayed with your comment

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

Get ZDNet UK's daily newsletter

Enter your email address to sign up

ZDNet UK Live

apexwm

NanWag : A Windows Server 2008 is being used because the environment that the Macs are in is a heavy Windows environment. I am proposing that...

37 minutes ago by apexwm on Windows Server 2008 drops the ball for Mac compatibility
BellamysIT

Really good article. You bring to light a few really good things. However, isn't it true that over 70% of fortune 500 companies use sharepoint?...

38 minutes ago by BellamysIT on Designing a SharePoint farm: Tiers before bedtime
annonymous2

If Piratebay is a crime then so is borrowing a dvd you purchased to a family member or a friend. Why should we not be aloud to share. Most of the...

2 hours ago by annonymous2 on UK ISPs ordered to block Pirate Bay website
NanWag

File Services For Macintosh was causing Excel to prompt for Overwriting changes or Save Another Copy because it was changing the timestamp on the...

3 hours ago by NanWag on Windows Server 2008 drops the ball for Mac compatibility
Regis Machado

creative cloud $48/month in the USA, £48/month in the UK ($79). good for the competitors

5 hours ago by Regis Machado via Facebook on Adobe move promotes piracy
Tom Espiner

Hello KosGirl, Good question. I've asked Belfius for a response. The latest post I can find on Pastebin about it is here:...

5 hours ago by Tom Espiner on Hackers hold bank to ransom over stolen data
KosGirl

Have there been any further updates to this story? I can't find any information on whether the hackers released the data or not.

6 hours ago by KosGirl on Hackers hold bank to ransom over stolen data
SandJ

I have done 7 speed tests this morning on different speed test tools. They tell me my download speed is: 12.3, 12.3, 12.3, 11.1, 12.7, 12.7, 11.7...

7 hours ago by SandJ on Watchdog: TalkTalk's broadband speed test misled users
Jack Schofield

@Mary Microsoft could always send Mozilla a spec sheet and oblige them to meet the same standards as IE. Then Mozilla can spend millions of...

10 hours ago by Jack Schofield on Windows RT browsers and the point of Windows RT
goth1csnake3

Not before time, that people making films,dvd's get whats coming to them. Well done, Virgin Media.

12 hours ago by goth1csnake3 on Virgin Media: Spotify deal will bring down piracy
Simon Bisson and Mary Branscombe

Apex - the question then is what about letting the user choose to have a tablet where they don't have to have that responsibility? why can't the...

22 hours ago by Simon Bisson and Mary Branscombe on Windows RT browsers and the point of Windows RT
Simon Bisson and Mary Branscombe

Moley, Apex, thanks; I think there's an interesting other dimension of choice - the choice to have a platform that is 'locked down' in the sense...

22 hours ago by Simon Bisson and Mary Branscombe on Mozilla accuses Microsoft of shutting Firefox out of WOA
Yellowcave

Not surprised. I once used the methods to let my firewall just notify me of breaches. Not one single logged event was genuine. Once, we all...

1 day ago by Yellowcave on Mobile porn filters catch innocent content, says report
duplex

live realy sucks in facebook becuase people hack your profile

1 day ago by duplex on Irish watchdog: Facebook privacy still falls short
Ed Macnair

If only it was that simple. When you start accessing Cloud applications you are stuck with the security model the vendor provides...........unless...

1 day ago by Ed Macnair via Facebook on IT security? You're doing it wrong!
Phil at Cloud4

Another good updaet, I have enjoyed going on the journey reading this series on SharePoint 2010 and have learned alot. Great writing.

1 day ago by Phil at Cloud4 on Designing a SharePoint farm: Tiers before bedtime
muteen

roumers of an ipad Mini, isnt that just an iTouch!?

1 day ago by muteen on Apple rebrands iPad 4G as 'Wi-Fi + Cellular' for UK
apexwm

Thanks for this article and bringing this issue to light. Unfortunately this type of activity is common not only with Adobe, but many other...

1 day ago by apexwm on Adobe move promotes piracy
Andy Bolstridge

there's a very thin line between tax avoidance and tax efficiency - earning £850 a month and claiming dividends to bring my income up to normal...

1 day ago by Andy Bolstridge via Facebook on The Idle Self-employed
Andy Bolstridge

I see that they are happy to announce these numbers.. but no-one will take any notice until they start announcing sales numbers too.

1 day ago by Andy Bolstridge via Facebook on Microsoft's score card for Smoked by Windows Phone