An important goal in Unix security is to disable services or daemons that are not necessary for normal system operations. In this article, we provide a brief overview of Unix services that should be disabled on most production Unix servers. These services have been targeted for attack in previous years.
Threats can be greatly reduced where these services are not enabled. The best defense is to disable services that are not needed. This area is a high priority for IT security professionals and IT auditors. Thankfully, guidance is available on what services are necessary and should be enabled and what services are not necessary and should be disabled.
To identify active services and the associated port numbers, we recommend using the Internet Assigned Numbers Authority (IANA). Services and ports have been standardized and documented in the IANA online database of well-known ports (superseding the previous RFC 1700). This database is available at the URL provided in the reference section below.
Regardless of the Unix vendor or version, these services and ports are consistent. There is a port number and protocol type (TCP/UDP) for each service which is activated through the Unix /etc/inet/services file. Specific configuration characteristics for each service are setup in the /etc/inet/inetd.conf file. Unix file permissions and ownership for these files should be restricted to administrators only - there is no reason to grant 'world' access.
The CIS Solaris Benchmark recommends creating a secure baseline of system services. With such a baseline, it is then possible to monitor for deviations and potential vulnerabilities. This baseline would be useful to system administrators, security professionals and auditors.
We have compiled the list of services below from the Center for Internet Security (CIS) Benchmark, the US Department of Defense Security Technical Implementation Guide (STIG) and from our professional IT audit experience. This list is by no means comprehensive since there are potentially thousands of services that may be active. This must be a customized approach since what is unnecessary in one organization may be very necessary in another organization. For the following services, consider carefully whether each should be active or not:
-Telnet is the virtual terminal service. It is only required to telnet to the server itself. Otherwise it can be disabled. -File Transfer Protocol. Two ports are used - FTP commands and actual data transfer. It is required only on an FTP server. Otherwise it can be disabled. -Trivial File Transfer Protocol (TFTP). It is required only for TFTP boot servers. Otherwise it can be disabled. -rlogin/rsh/rcp remote services are required only if the server must receive inbound requests. These are vulnerable services and can usually be disabled. -rexec remote service is required only if the system must receive inbound 'exec' requests. This is a vulnerable service and can usually be disabled. -DHCP is used for dynamically assigning IP addresses and other network information. It is required only for a DHCP server. Otherwise it can be disabled. -SMTP is used to transport email from system to system. It is only required if the system must receive mail from other systems. Otherwise it can be disabled. -Domain Name System (DNS) name resolution service. This service is only required for DNS primary or secondary servers. It can be disabled for DNS clients. -Network Filesytem (NFS) is used to access remote file systems. It is required only if the system is an NFS server. Otherwise it can be disabled. -Network Information Service (NIS/NIS+) server is used for network-based authentication. It is only required on systems that are acting as an NIS server for the local site. Otherwise it can be disabled. -'Route' is used only if the system is a network router. It is almost always not required.
References: Unix - Security Technical Implementation Guide (STIG). Version 5. 2005. US Defense Information Systems Agency. US Department of Defense. http://iase.disa.mil/stigs/stig/unix-stig-v5r1.pdf
Solaris Benchmark v2.1.3 (Solaris 10). The Center for Internet Security (CIS). 2007. http://www.cisecurity.org
Internet Assigned Numbers Authority (IANA) http://www.iana.org/assignments/port-numbers
About the Author:
Looking for certified IT auditors at reasonable rates. Continental Audit Services, is your provider to control risks, improve security and comply with regulations. IT best practices applied to all major operating systems, databases and other technology. Visit www.continentalaudit.com.
Google
Facebook
Twitter
Myspace
Yahoo
Digg
del.icio.us
Windows Live
Reddit
Blogger
Rain Concert
