xinetd.d

Tigger · 06-17-2003, 01:40 AM

how do i edit this file? I am using red hat 8 server.

I want to edit this file so that i can disable some services such as echo and chargen.

Also what is the correct way of disabling these in the file? Can i just put a # in front of the service?

thanks again

Crashed_Again · 06-17-2003, 02:16 AM

xinetd.d is a directory in /etc. To disable the services you edit the appropriate files in /etc/xinetd.d . For instance, the file /etc/xinietd.d/chargen will have a line that looks like this:

disable = no

You can change it to:

disable = yes

and then restart xinetd(/etc/init.d/xinetd restart) for the changes to take effect.

Tigger · 06-17-2003, 02:30 AM

ok, great

thanks heaps!!!

I love you crashed_again!!!!

MasterC · 06-17-2003, 02:34 AM

Woohoo! Feel the love in the forums...

Cool

Tigger · 06-17-2003, 07:59 PM

Booo whooooo!!!!

guess what? I got to the xinetd.d directory and yes there is a service for echo and chargen and both were set to disable.

However, i was also after the services such as tftp and RIP and SNMP but they were not in there!!!

Where else are these service files located on the machine? I run languard from the internet and it says i have got these ports open however, i cannot seem to find out where they are and how to disable them.

Please help me !!!

MasterC · 06-17-2003, 09:30 PM

chkconfig is probably what you are looking for

Cool

Tigger · 06-17-2003, 11:27 PM

hi masterC, i have tried this (chkconfig) in the past but was not successful in finding tftp. I do not understand where languard is getting these ports open from?

MasterC · 06-17-2003, 11:43 PM

Use your IPTables to close em if that's where your concern stems from

Cool

Tigger · 06-17-2003, 11:45 PM

ok, if i close them using iptables then even if they show up using languard it does not matter? Is this what you are saying?

I just do not understand where languard is getting them from?

neo77777 · 06-18-2003, 12:20 AM

You must restart xinetd after you made changes
/etc/rc.d/inet.d/xinetd reload
or
kill -SIGUSR1 `cat /var/run/xinetd.pid`
or the last resort is reboot but it is a preragative of another OS

moses · 06-18-2003, 01:19 AM

These processes may be starting as daemons, not as subprocesses of xinetd. To check that, do:

Code:

ps auxww | grep tftp
etc.

tftp listens at port 69 by default, so as root, you can do a netstat and look for port 69.

Code:

netstat -lnp

will give you useful information about which ports are kept open by which processes. The ports show up under the local address column, after the colon (:).

Tigger · 06-18-2003, 02:13 AM

ok, neo - yes, i have done this but still languard shows they are open.

Moses - if the processes are starting as daemons, then what can i do about it? How can i stop them?

thanks again everyone

I love these groups!!! Everyone has been very helpful.

Looking_Lost · 06-18-2003, 02:37 AM

Just a thought - if it is your external IP you are scanning with languard there's a chance it could be your ISP's proxy that it is showing having these ports open not your computer - is it the same for the internal IP?

I'd set my firewall to high, scan it again and if languard came up with the same results I'd start to doubt it or try nmap and see what that comes up with too.

moses · 06-18-2003, 03:14 AM

Look in /etc/rc.d or /etc/init.d for starters. Anyway, there'll be startup scripts somewhere (most likely under /etc) and you can either chmod -x them or comment out the relevant parts of the scripts. . .
I don't know what distribution you are using, but it makes a difference to where the files are and how you stop programs from running.

MasterC · 06-18-2003, 03:41 AM

Assuming you don't use these apps, can you not simply remove them from your system?

Cool