SUMMARY: why so many ports open on Solaris

choogend_at_library.umass.edu

Date: Wed, 28 Apr 2004 14:09:35 -0400
To: Sun Managers <sunmanagers@sunmanagers.org>


-- 
     Simon the stressed
     http://www.bpfh.net/
     simes@bpfh.net
     Chocolate is *not* a substitute for sleep
-------- Original Message --------
Subject: Re: why so many ports open on Solaris
Date: Tue, 27 Apr 2004 23:34:05 -0400
From: Steve Sandau <ssandau@gwi.net>
Reply-To: ssandau@bath.tmac.com
To: Chris Hoogendyk <choogend@library.umass.edu>
References: <408F0C9F.4030603@library.umass.edu>
If you never run CDE or any other GUI, you can have like 2 ports open. I
do this on an Oracle server on Sol 8. CDE, Gnome and so on open up
(need?) many ports to start with. In addition many other optional
services run out of scripts in /etc/rc2.d. I can't give you a list, but
I have tracked many down in the past by reading the script and looking
at the man page for the particular binary.
I think that KDE, Gnome and others open lots of ports on Linux as well.
Really minimal ports open is related to the window manager, not the OS.
My opinion anyway... ;)
SteveS
-------- Original Message --------
Subject: RE: why so many ports open on Solaris
Date: Wed, 28 Apr 2004 08:31:30 -0400
From: William Enestvedt <William.Enestvedt@jwu.edu>
To: Chris Hoogendyk <choogend@library.umass.edu>
    Well, not everyuthing listening on a port gets started via inetd, if 
I recall correctly. (See the instructions for installing TCP Wrappers: 
the explanation of the two methods of installation might shed more light 
on this than I can.)
    Also, you restarted inetd after changing its conf file,right? :7)
    SANS publishes a book about securing Solaris that's quite good; if 
you read through it, it explains why certain services are being disabled 
-- but I must confess that it wants you to accet their assurances pretty 
blindly.
    I have taken to disabling a lot of the things in /etc/rc2.d and 
rc3.d, but I try to read the man pages to figure out whether I can get 
by without them (like picld, which I'd love to shut off but which I 
*think* is required by Solaris) before I kill them.
    Suns "JASS Toolkit" for securing Jumpstarting Solaris systems 
contains scripts for securing various services and ports. You could 
probably glean a lot from reading the supporting paper on the Sun 
Blueprints site.
    I think many Linux distributions use xinetd to start more 
services/deamons/processes than Solaris does, which is why they can rely 
on keeping more things disabled by default (feeling safe that the right 
stuff will get launched when it tickles xinetd). But I could be wrong.
-wde
--
Will Enestvedt
UNIX System Administrator
Johnson & Wales University -- Providence, RI
William.Enestvedt@jwu.edu
-------- Original Message --------
Subject: Re: why so many ports open on Solaris
Date: Wed, 28 Apr 2004 10:58:57 -0400
From: Andrew J Caines <A.J.Caines@halplant.com>
Reply-To: Andrew J Caines <A.J.Caines@halplant.com>
Organization: H.A.L. Plant
To: Chris Hoogendyk <choogend@library.umass.edu>
References: <408F0C9F.4030603@library.umass.edu>
Chris,
You should have exactly as many ports open as are used by the network 
services you want offered by the system, no more.
inetd is just one handler of network services. Solaris comes with a 
bucketload of other server which start by default on install, or after 
patching which puts the start scripts back. You are expected to manually 
turn them off, or better not install the software in the first place.
See the setup_rc script[1], which makes the process of removing all 
unwanted startup scripts. Run it after install and patching.
Consider removing the packages containing the software you don't use.
Since you didn't mention any details, you need to find out what's 
listening on those ports. I suggest using "lsof -i" and looking for 
processes in a LISTEN state on each port. You can look for the process 
listening on a particular port by specifying it, eg.
# lsof -i :22
COMMAND PID USER FD  TYPE	 DEVICE SIZE/OFF NODE NAME
sshd    257 root  3u IPv6 0x30001e54638      0t0  TCP *:ssh (LISTEN)
sshd    257 root  4u IPv4 0x30001e547b8      0t0  TCP *:ssh (LISTEN)
A good reference is Alex Noordergraaf's Sun Blueprints, "Minimizing the 
Solaris Operating Environment for Security"[2] and "Solaris Operating 
Environment Minimization for Security: A Simple, Reproducible and Secure 
Application Installation Methodolgy"[3]. Other Blueprints will probably 
be of interest to you, too.
[1] http://halplant.com:88/software/Solaris/scripts/setup_rc
[2] http://www.sun.com/blueprints/1102/816-5241.pdf
[3] http://www.sun.com/blueprints/1100/minimize-updt1.pdf
-Andrew-
  _______________________________________________________________________
| -Andrew J. Caines-   Unix Systems Engineer   A.J.Caines@halplant.com
-------- Original Message --------
Subject: Re: why so many ports open on Solaris
Date: Wed, 28 Apr 2004 10:34:05 +0200
From: Gandalf el gris <gandalf@tierramedia.org>
To: Chris Hoogendyk <choogend@library.umass.edu>
References: <408F0C9F.4030603@library.umass.edu>
Hi Chris
By default Sun Soalris come with a lot of open services. If you want to 
close these services you can use a Security tool like JASS or Titan, or 
make it by your self with a guide, a very good book about that is 
syngress Hard Proffig Sun Solaris.
With JASS you can harden your sistem clossing almost all open ports, or 
  securizing them. JASS is a Sun developed software and is the tool that 
SUN use to harden their systems.
I hope this can help you.
Cheers
     MArcos
-------- Original Message --------
Subject: Re: why so many ports open on Solaris
Date: Wed, 28 Apr 2004 10:25:14 -0400 (EDT)
From: Mark Montague <markmont@umich.edu>
To: Chris Hoogendyk <choogend@library.umass.edu>
References: <408F0C9F.4030603@library.umass.edu>
You can install a copy of lsof.  It doesn't come standard with Solaris 
8, but you can get it from ftp://vic.cc.purdue.edu/pub/tools/unix/lsof
Running "lsof -i" will tell you what processes are using which ports. 
This will tell you which /etc/init.d scripts to disable.
If you are not actually using a port, you should not have it open, in my 
opinion.  A common mistake is to leave a port open because you might 
need it.  Turn off the service, and if you ever wind up needing it, turn 
it on (permanently) then.
                 Mark Montague
                 LS&A Information Technology
                 The University of Michigan
                 markmont@umich.edu
-------- Original Message --------
Subject: Re: why so many ports open on Solaris
Date: Wed, 28 Apr 2004 13:19:04 -0400
From: Rich Kulawiec <rsk@gsp.org>
To: Chris Hoogendyk <choogend@library.umass.edu>
References: <408F0C9F.4030603@library.umass.edu>
On Tue, Apr 27, 2004 at 09:45:03PM -0400, Chris Hoogendyk wrote:
 > Why does Solaris (e.g. 8) have so many ports open even when I've gone
 > through inetd.conf and commented out virtually everything?
The glib answer:
Because Sun ships systems that way in order to minimize support costs to 
them: otherwise they'd be fielding an endless stream of "Why doesn't FOO 
work?" calls.  Compare/contrast with OpenBSD, which ships with darn near 
everything turned off by default.
The more useful answer:
Because while inetd "listens on behalf of other daemons" and thus opens 
those ports that those daemons provide services on, some daemons and 
other processes do their own listening: thus any ports that they choose 
to open are, uh, open.
 > Does anyone know where there is a guide or discussion of the absolute
 > minimum necessary and what you lose or don't lose by shutting down
 > everything else? I don't want to use a port blocking mechanism. I use
 > tcpwrappers to regulate access to ports that I do want open. It seems I
 > should find the source of excess ports and actually shut down the
 > processes that are opening them. I presume a lot of them come from rc2.d
 > or rc3.d.
The best answer to this is "it depends", because which ones you can turn 
off without disabling a vital service depends on which services are 
vital to you.
I can offer three bits of guidance:
	1. Get lsof, as mentioned in the Sun-Manager's FAQ, because
	running lsof will enable you to figure who has which port(s)
         open.
	2. Resist the temptation to disable everything at once.  Again,
	this depends on what you're doing with your system, but even
         when I *know* that eventually I will probabbly end of turning
         off lots of things, I've found it better to take things one step
         at a time, and make sure -- after each change -- that everything
         I think should still be working IS still working.
	3. Things that I find that I can often disable without screwing
	things up (and these are from Solaris 9, so salt to taste):
		nfs.client
		nfs.server
		lp
		keymap
		sendmail
		volmgt
		autofs
		init.snmpdx
		init.dmi
		picld
		skipkey
---Rsk
-------- Original Message --------
Subject: Re: why so many ports open on Solaris
Date: Tue, 27 Apr 2004 23:34:48 -0600
From: Colin Bigam <colin@west.gecems.com>
Reply-To: colin@west.gecems.com
To: Chris Hoogendyk <choogend@library.umass.edu>
References: <408F0C9F.4030603@library.umass.edu>
Hi Chris;
First of all, if services are shut down in inetd, then you'll probably 
find about five remaining ports open. Sendmail(port 25) is one you can 
shut down in Solaris 8, and still mail out stuff from that machine. 
nfs.client can safely be shut down if the machine won't be NFS mounting 
anything.
The remaining few are probably RPC-related ports. It's close to 
impossible to shut down RPC entirely, so you'll have to look at 
deregistering them. Getting this far will eliminate nearly all of the 
open ports.
As for a guide, Sun has a whitepaper on hardening Solaris/Sparc. Look 
that up, and you'll get quite a few interesting bits of info.
Colin
--
Colin Bigam
Senior Unix Analyst, GEITS
colin@west.gecems.com
(403) 699-4584
-------- Original Message --------
Subject: RE: why so many ports open on Solaris
Date: Tue, 27 Apr 2004 23:25:40 -0400
From: Roetman, Paul <PRoetman@csxwt.com>
To: Chris Hoogendyk <choogend@library.umass.edu>
Sun put out this doc:
   Minimizing the Solaris Operating Environment for Security
   816-5241.pdf
Which has some quite good reading!
Cheers
Paul
-------- Original Message --------
Subject: 	RE:why so many ports open on Solaris
Date: 	Wed, 28 Apr 2004 14:39:42 +0200
From: 	Pavic, Aleksander <Aleksander.Pavic@telekom.de>
To: 	choogend@library.umass.edu
Hi,
rpc Services are not handled with /etc/inetd.conf. If you really want to 
disable everything and open just the things you  need, you have to 
disable the S71rpc script in /etc/rc2.d.
But think about your needs, some services need rpc (like nis,nfs,)
There are probably some other services that are not controled by rpc or 
  inetd.conf. Then you have to disable the startscript for this service.
To find out the startscript for a service thats called "lala" you can 
mostly find all scripts with 'find /etc/rc?.d | xargs grep -i lala'.
HTH
Aleks
-------- Original Message --------
Subject: RE: why so many ports open on Solaris
Date: Wed, 28 Apr 2004 08:40:15 -0400
From: Brent Mcdaniel <Brent.McDaniel@TheICE.com>
To: Chris Hoogendyk <choogend@library.umass.edu>
Chris,
We tie our boxes down to only ssh and whatever app is running on it, 
i.e. Weblogics, database, etc.... So if you have commented out almost 
everything in /etc/inetd.conf and HUP'd it, then the only other place 
would be in /etc/rc2.d and /etc/rc3.d
If you want to give me a list from a "netstat -an | grep LISTEN" and 
"netstat -an | grep Idle", I'd be happy to tell you what ports those are 
and how to stop that process.
Brent
  	I n t e r c o n t i n e n t a l E x c h a n g e	
  _____________________________________________
    Brent McDaniel  |  http://www.intcx.com |
    Senior Systems Administrator          cell
-------- Original Message --------
Subject: Re: why so many ports open on Solaris
Date: Wed, 28 Apr 2004 09:31:56 -0400
From: Matt Clausen <mclausen@csit.fsu.edu>
To: Chris Hoogendyk <choogend@library.umass.edu>
References: <408F0C9F.4030603@library.umass.edu>
A lot of the inetd processes will hang around even after you restart the 
  inetd server (either by a kill -HUP to force it to reread its 
configuration file or killing it all together and restarting it). If you 
  reset the box you may find that a lot of the open ports will disappear.
You can also use tools like nmap to scan these ports and it will often 
give you some clues as to what the ports that are open are.
-------- Original Message --------
Subject: Solaris network ports open
Date: Wed, 28 Apr 2004 08:31:54 -0400
From: Schernau, Ed <Edward.Schernau@citizensbank.com>
To: 'choogend@library.umass.edu' <choogend@library.umass.edu>
Just install ipfilter, then they won't see any ports open.  I routinely 
do it here, to mask my machines from prying eyes.  Set up a policy to 
drop all but the stuff you know about.
Ed Schernau
Systems Management Specialist, ECC
Citizens Bank, East Providence Operations Center
401.282.1262 ed.schernau@citizensbank.com
-------- Original Message --------
Subject: Re: why so many ports open on Solaris
Date: Wed, 28 Apr 2004 00:47:36 -0500
From: Kelly Setzer <Kelly.Setzer@LiquidChicken.org>
To: Chris Hoogendyk <choogend@library.umass.edu>
References: <408F0C9F.4030603@library.umass.edu>
  <snip>
In my crankier moods, I dream about just typing 'killall' and
pronouncing the system "secure".
Kelly
  < ;-) >
-------- Original Message --------
Subject: Re: why so many ports open on Solaris
Date: Wed, 28 Apr 2004 00:58:37 -0500 (EST)
From: J. Oquendo <sil@politrix.org>
To: Chris Hoogendyk <choogend@library.umass.edu>
References: <408F0C9F.4030603@library.umass.edu>
You more than likely have some of the RPC services open.
Grab yourself a copy of lsof from Sunfreeware.com if you don't have it 
and lsof|grep -i listening to see what exactly is accessing what port 
using what.
Another thing you may want to do to really restrict the machine itself 
is looking into using ACL's if you have users, and running Titan on the 
machine. Titan is available for free via www.fish.com and is a pretty 
nifty tool.
TCP Wrappers if you ask me are rather obsolete I haven't used them since 
about 1998 or so. Currently on my personal machine I have it modified by 
Titan which resolves almost 95% of the problems, I've got most known 
patches I need, and I have a modified version of Pitbull running on ths 
machine. (www.argus-systems.com) Although Pitbull is not free, it is 
worth picking up if you have a budget.
Other tools I used are for deception. Modified DTK (Deception Tool Kit), 
Port Sentry. I used to run Snort to maintain awareness of who was doing 
what but too many false positives, and a high load on the system made me 
chuck it.
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
-------- Original Message --------
Subject: Re: why so many ports open on Solaris
Date: Tue, 27 Apr 2004 19:03:06 -0700
From: Roy S. Rapoport <rsr@inorganic.org>
To: Chris Hoogendyk <choogend@library.umass.edu>
References: <408F0C9F.4030603@library.umass.edu>
*TWO* ports? These sort of naive fools are what makes security so hard! 
An open port is an invitation to hacking, which is why I prefer to keep 
my systems with all network ports closed, superglue gumming up the 
serial and network interfaces, power disconnected, and the machine 
itself embedded in half a ton of concrete.  That's the only way to be sure!
Sorry :)
You likely need exactly as many ports open as services you're offering, 
no more and no less.  This likely means 1 (remote access) + whatever 
public services you're offering.
For servers, this is quite easy -- if you've got a web server, you 
really should only have, say, 22 (for ssh) and 80 open.
For desktops it gets a bit ugly because every full-featured desktop 
system out there seems to rely on network ports for some of its 
communication.
Regardless, there are two sources for open ports on Solaris (well, and 
other systems):
inetd will spawn ports if it's configured to do so; and server processes 
will always be listening on a given port.
You *can* -- and *should* -- run through every process running on the 
machine, familiarize yourself with it, and know what it does.
You *can* -- and *should* -- then go and check out JASS, the Jumpstart 
Architecture and Security Scripts, AKA the Solaris Security Toolkit. 
JASS, when integrated with Jumpstart, will result in systems that come 
out of the jumpstart process nicely tight.  JASS is also a really nice 
architecture to manage Jumpstart, by the way.
Hope this helps,
-roy
-------- Original Message --------
Subject: Re: why so many ports open on Solaris
Date: Tue, 27 Apr 2004 20:57:19 -0500 (CDT)
From: Mike's List <mikelist@sky.net>
To: Chris Hoogendyk <choogend@library.umass.edu>
So list the ports so other can see what it is and tells you where it's
coming from.
Yes, some ports are open with some services are enable, in /etc/rc2.d
and /etc/rc3.d. ie. if you don't need /etc/rc3.d/S16boot.server, stop
the process and rename the file so it won't start.
www.sun.com/bigadmin --start here and search.
http://www.spitzner.net/
http://www.fish.com/titan/
http://www.yassp.org/
- Mike
_______________________________________________
sunmanagers mailing list
sunmanagers@sunmanagers.org
http://www.sunmanagers.org/mailman/listinfo/sunmanagers

SUMMARY: why so many ports open on Solaris

Relevant Pages