1. 153 Configuring and Securing ARPA/Berkeley Services Version A.01 H3065S Module 13 Slides

2. © 1999 Hewlett-Packard Co. H3065S A.01 154 Internet Services Overview a673141 Capability ARPA Berkeley Dynamic routing gated Time synchronizationNTP Remote bootBOOTP Terminal access telnetrlogin File transfer ftp, tftprcp Remote command execution remsh, rexec Electronic mailSMTPsendmail (uses SMTP) Interprocess communicationSockets Network information rwho, ruptime, finger Name serviceBIND Remote printing printer ( rlpdaemon )

3. © 1999 Hewlett-Packard Co. H3065S A.01 155 Internet Service Clients and Servers a673142 Servers provide a service. Clients use a service. # rlogin gary roger gary rlogind

4. © 1999 Hewlett-Packard Co. H3065S A.01 156 Starting Internet Services via /sbin/rc a673143 /sbin/init.d/* /sbin/rc2.d/S* Execution Scripts gated inetd named rwhod xntpd sendmail Configuration Files /etc/rc.config.d/netconf /etc/rc.config.d/netdaemons Linked to /sbin/rc /sbin/init /etc/rc.config.d/mailservs /etc/rc.config.d/namesvrs

5. © 1999 Hewlett-Packard Co. H3065S A.01 157 Starting Internet Services via inetd a673144 inetd $ telnet gary inetd telnetd telnet /etc/inetd.conf /etc/services /var/adm/inetd.sec roger gary

6. © 1999 Hewlett-Packard Co. H3065S A.01 158 Configuring /etc/inetd.conf a673145 # inetd -c : ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l telnet stream tcp nowait root /usr/lbin/telnetd telnetd # login stream tcp nowait root /usr/lbin/rlogind rlogind shell stream tcp nowait root /usr/lbin/remshd remshd : Q: Should I provide FTP service? Q: How do I start an ftp daemon? inetd /etc/inetd.conf has the answer!

7. © 1999 Hewlett-Packard Co. H3065S A.01 159 Configuring /etc/services a673146 /etc/services has the answer! ftp 21/tcp # File Transfer Protocol (Control) telnet 23/tcp # Virtual Terminal Protocol login 513/tcp # remote login shell 514/tcp # remote command, no passwd used : : Q: Which port should I monitor for FTP requests? inetd

8. © 1999 Hewlett-Packard Co. H3065S A.01 160 Configuring /var/adm/inetd.sec a69815 Q: Which clients are allowed FTP access? inetd /var/adm/inetd.sec has the answer! telnet deny 128.1.*.* shell allow 192.1.1.* 192.1.3.* login allow 192.1.1-3.* host1 host2 : : ftp deny 128.1.1.1

9. © 1999 Hewlett-Packard Co. H3065S A.01 161 Configuring inetd Logging a673148 inetd -l /var/adm/syslog/syslog.log has the answer! Edit Sep 5 15:51:10 host1 inetd[2234]: telnet/tcp: Connection from host1 Sep 5 15:51:27 host2 inetd[2251]: login/tcp: Connection from host2 syslogd /etc/rc.config.d/netdaemons export INETD_ARGS=“-l” # Enable inetd logging at every boot by # setting the INETD_ARGS variable here! Which clients have requested which internet services from my server?

10. © 1999 Hewlett-Packard Co. H3065S A.01 162 System and User Equivalency a673149 # rlogin gary Password: ****** Welcome to gary! # rlogin gary Welcome to gary! Without Equivalency: With Equivalency: System and user equivalency: allows some or all users password-free access to a host only apply to Berkeley services ( rlogin, remsh, rcp ) configured via: /etc/hosts.equiv and ~/.rhosts

11. © 1999 Hewlett-Packard Co. H3065S A.01 163 Configuring /etc/hosts.equiv a673150 login: leo /etc/hosts.equiv 1 $ rlogin host2 2 3 4 $ rlogin host2 -l tom $ remsh host3 ll $ remsh host3 -l tom ll 5 rcp host2:.profile. host1 -sue host1 host1 tom login: sue host1 host2 host3 Which command succeeds?

12. © 1999 Hewlett-Packard Co. H3065S A.01 164 Configuring ~/.rhosts a673151 login: leo 1 rlogin host2 -l root 2 3 remsh host2 ll remsh host2 -l sue ll 4 rlogin host2 Question: Which command succeeds? host1 host2 login: sue 5 rcp leo@host2:.profile. ~root/.rhosts host1 ~sue/.rhosts host1 sue host1 joe ~leo/.rhosts host1 -sue host1 +

13. © 1999 Hewlett-Packard Co. H3065S A.01 165 FTP Configuration Issues a69816 Clients: Configuring FTP autologin machine host2 login user1 password abcde12 machine host3 login user1 password 12abcde ~/. netrc (rw-------) Servers: Using /etc/ftpusers to deny FTP access to selected users guest orderentry /etc/ftpusers (r--r--r--) Servers: Configuring anonymous FTP access ftp:*:500:10:Anon FTP:/home/ftp:/usr/bin/false /etc/passwd (r--r--r--)

14. © 1999 Hewlett-Packard Co. H3065S A.01 166 ARPA/Berkeley Services Review a69817 inetd ftpd telnetd /etc/inetd.conf /etc/services /var/adm/inetd.sec remshd & rlogind /etc/hosts.equiv ~/.rhosts /etc/passwd syslog.log ~/.netrc /etc/ftpusers