153 Configuring and Securing ARPA/Berkeley Services Version A.01 H3065S Module 13 Slides

© 1999 Hewlett-Packard Co. H3065S A Internet Services Overview a Capability ARPA Berkeley Dynamic routing gated Time synchronizationNTP Remote bootBOOTP Terminal access telnetrlogin File transfer ftp, tftprcp Remote command execution remsh, rexec Electronic mailSMTPsendmail (uses SMTP) Interprocess communicationSockets Network information rwho, ruptime, finger Name serviceBIND Remote printing printer ( rlpdaemon )

© 1999 Hewlett-Packard Co. H3065S A Internet Service Clients and Servers a Servers provide a service. Clients use a service. # rlogin gary roger gary rlogind

© 1999 Hewlett-Packard Co. H3065S A Starting Internet Services via /sbin/rc a /sbin/init.d/* /sbin/rc2.d/S* Execution Scripts gated inetd named rwhod xntpd sendmail Configuration Files /etc/rc.config.d/netconf /etc/rc.config.d/netdaemons Linked to /sbin/rc /sbin/init /etc/rc.config.d/mailservs /etc/rc.config.d/namesvrs

© 1999 Hewlett-Packard Co. H3065S A Starting Internet Services via inetd a inetd $ telnet gary inetd telnetd telnet /etc/inetd.conf /etc/services /var/adm/inetd.sec roger gary

© 1999 Hewlett-Packard Co. H3065S A Configuring /etc/inetd.conf a # inetd -c : ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l telnet stream tcp nowait root /usr/lbin/telnetd telnetd # login stream tcp nowait root /usr/lbin/rlogind rlogind shell stream tcp nowait root /usr/lbin/remshd remshd : Q: Should I provide FTP service? Q: How do I start an ftp daemon? inetd /etc/inetd.conf has the answer!

© 1999 Hewlett-Packard Co. H3065S A Configuring /etc/services a /etc/services has the answer! ftp 21/tcp # File Transfer Protocol (Control) telnet 23/tcp # Virtual Terminal Protocol login 513/tcp # remote login shell 514/tcp # remote command, no passwd used : : Q: Which port should I monitor for FTP requests? inetd

© 1999 Hewlett-Packard Co. H3065S A Configuring /var/adm/inetd.sec a69815 Q: Which clients are allowed FTP access? inetd /var/adm/inetd.sec has the answer! telnet deny *.* shell allow * * login allow * host1 host2 : : ftp deny

© 1999 Hewlett-Packard Co. H3065S A Configuring inetd Logging a inetd -l /var/adm/syslog/syslog.log has the answer! Edit Sep 5 15:51:10 host1 inetd[2234]: telnet/tcp: Connection from host1 Sep 5 15:51:27 host2 inetd[2251]: login/tcp: Connection from host2 syslogd /etc/rc.config.d/netdaemons export INETD_ARGS=“-l” # Enable inetd logging at every boot by # setting the INETD_ARGS variable here! Which clients have requested which internet services from my server?

© 1999 Hewlett-Packard Co. H3065S A System and User Equivalency a # rlogin gary Password: ****** Welcome to gary! # rlogin gary Welcome to gary! Without Equivalency: With Equivalency: System and user equivalency: allows some or all users password-free access to a host only apply to Berkeley services ( rlogin, remsh, rcp ) configured via: /etc/hosts.equiv and ~/.rhosts

© 1999 Hewlett-Packard Co. H3065S A Configuring /etc/hosts.equiv a login: leo /etc/hosts.equiv 1 $ rlogin host $ rlogin host2 -l tom $ remsh host3 ll $ remsh host3 -l tom ll 5 rcp host2:.profile. host1 -sue host1 host1 tom login: sue host1 host2 host3 Which command succeeds?

© 1999 Hewlett-Packard Co. H3065S A Configuring ~/.rhosts a login: leo 1 rlogin host2 -l root 2 3 remsh host2 ll remsh host2 -l sue ll 4 rlogin host2 Question: Which command succeeds? host1 host2 login: sue 5 rcp ~root/.rhosts host1 ~sue/.rhosts host1 sue host1 joe ~leo/.rhosts host1 -sue host1 +

© 1999 Hewlett-Packard Co. H3065S A FTP Configuration Issues a69816 Clients: Configuring FTP autologin machine host2 login user1 password abcde12 machine host3 login user1 password 12abcde ~/. netrc (rw ) Servers: Using /etc/ftpusers to deny FTP access to selected users guest orderentry /etc/ftpusers (r--r--r--) Servers: Configuring anonymous FTP access ftp:*:500:10:Anon FTP:/home/ftp:/usr/bin/false /etc/passwd (r--r--r--)

© 1999 Hewlett-Packard Co. H3065S A ARPA/Berkeley Services Review a69817 inetd ftpd telnetd /etc/inetd.conf /etc/services /var/adm/inetd.sec remshd & rlogind /etc/hosts.equiv ~/.rhosts /etc/passwd syslog.log ~/.netrc /etc/ftpusers