Improve Linux security

By Mary Ann Richardson, TechRepublic, 8 October, 2002 10:39

The results are also shown in Figure B. You'll notice that they are significantly different from the results shown in Figure A. Unlike in inetd, this command will not show you which services xinetd is listening for. To see those services, you must list the files in the /etc/xinetd.d directory, which is the equivalent of the /etc/inetd.d directory used by inetd. To do so, enter the command:ls -l /etc/xinetd.d/*

Figure C

The results, shown in Figure C, indicate which services xinetd is listening for. To turn off a service you don't want xinetd to run, you need to edit the file for that particular service. For example, to turn off talk, you would edit the /etc/xinetd.d/talk file using vi or another text editor, so that disable equals yes, as shown in Figure D. Note that you will need to restart xinetd for any configuration changes to take effect.

Figure D

Services not run by the inetd or xinetd daemons
While the configuration files of the inetd and xinetd daemons are useful in determining which network services have been started by these super daemons, not all network services are or should be under their control. Increasingly, network services are being configured to start independently at system startup. Their startup scripts can be found in the /etc/rc.d directory. To access this directory and view a listing, open a terminal window and enter the following commands:cd /etc/rc.dls -l rc*.d

Figure E

As Figure E shows, the /etc/rc.d directory contains seven subdirectories of start scripts that are invoked by the init process as the system enters the designated runlevel. For example, upon startup, a Red Hat workstation installed with X-Windows defaults to runlevel 5; init looks in the /etc/rc.d/rc5.d directory and runs each start script it finds listed there. If you press [Ctrl][Alt][F1] as root, you will be returned to the text-based login screen, or runlevel 3, at which level init will run the scripts found in rc3.d. To identify the scripts that will run under a particular runlevel, such as 3, enter the following command:cd rc3.dls -l

Figure F

Note that the partial listing of rc3.d shown in Figure F does not contain the actual scripts themselves, but symbolic links to them which are located in the /etc/r.d/init.d directory. As with stand-alone systems connected to the Internet, the ps command should be executed upon booting your system to see which daemons have actually been started. (Note that even though a script is supposed to run at a particular runlevel, it may not if the script requires a certain configuration that doesn't exist on your system.) If you don't want a specific service to run, you must find and delete the link to its start script from its corresponding /etc/rc*.d directory. Many Linux distributions include graphical system tools (e.g., Linuxconf or YaST) that can be used to stop unnecessary services without having to delete the scripts manually. Determine what's running now
After you have made changes to the inedt or xinedt configuration files and the rc.d directories, how can you be sure all unnecessary network services have been stopped? It is a good idea to run the netstat utility any time changes are made to the configuration files and upon reboot. To find out which ports are currently awaiting connections, enter netstat with the --inet and -a options, as shown in Figure G.

Figure G

Only by examining the output from the netstat command can you be sure that the changes you made have taken effect and that your system ports are not open to active services.

Have your say instantly in the
Tech Update forum. Find out what's where in the new Tech Update with our
Guided Tour. Let the editors know what you think in the
Mailroom.

« Previous
1
2
Next »

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

Please God no; teach them anything you like - thinking rationally, the uses and misuses of data, what data is and what it's not - but leave the...

2 hours ago by Tony Douglas via Facebook on Kids are the future. Teach ’em to code.

@Jack, > Works really well for thieves.... Nice attempt to deflect the argument by tossing in a point that's totally irrelevant, even it were...

17 hours ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

Make that 13 people now - I got refused today at Manchester airport. I thought I was up to date on this legislation - I knew of the EU ruling from...

20 hours ago by bootlegger on UK airport body scans will not be opt out

Don't forget to check out apps like GoodReader or SlideShark either, they're indispensible for people on the go in presentation situations. Best...

22 hours ago by tinycg on Four top iPad apps for people on the move

Well it seems there is something a number of us agree on. Why is the Ubuntu Unity launcher so ugly? I thought perhaps it was something to do with...

1 day ago by TerryRK on A tale of two distros: Ubuntu and Linux Mint

Duplicate comments are not made intentionally. Its very good to know that now you are keeping check on this problem because sometimes a commenter...

2 days ago by Freebies202 on Microsoft fixes blog comments, speeds up blogs with open source

"the very significant number of users" and "many (most) of us" - you have no evidence for these statements. It is a fact that most users are saying...

2 days ago by kevinmchapman on A tale of two distros: Ubuntu and Linux Mint