Re: security in sun solaris

[Lukas Sosnovec <lukas76cz () seznam cz>]

Hello Cristian,
You will probably not need most of these services. Look at /etc/rc2.d, /etc/rc3.d and /etc/inetd.conf. The good way is 
look for any file or line in inetd.conf on Internet and you will see what is it use for.

This link could be interesting for you (it's not new, but still good) 
http://sabernet.home.comcast.net/papers/Solaris.html

This one could help you understand the services: http://www.serverworldmagazine.com/sunserver/2000/11/attack.shtml


Unfortunatelly solaris version of netstat doesn't support -p, lsof will do the work.


Lukas



On Tue, 26 Aug 2003 09:17:01 +0700
Christian <christian () dnet net id> wrote:

> hi, i'm new at solaris, and i want to secure my solaris boxes, i 
> recently run nmap on one of my solaris box runing named service under 
> SunOS 5.6
> Port       State       Service
> 23/tcp     open        telnet
> 25/tcp     open        smtp
> 53/tcp     open        domain
> 111/tcp    open        sunrpc
> 256/tcp    open        rap
> 257/tcp    filtered    set
> 258/tcp    open        yak-chat
> 264/tcp    open        bgmp
> 265/tcp    open        unknown
> 540/tcp    open        uucp
> 4045/tcp   open        lockd
> 6112/tcp   open        dtspc
> 32771/tcp  open        sometimes-rpc5
> 32773/tcp  open        sometimes-rpc9
> 32774/tcp  open        sometimes-rpc11
> 32775/tcp  open        sometimes-rpc13
> 32776/tcp  open        sometimes-rpc15
>
> anyone know what this services for? and how turned these off? well, 
> except for telnet,smtp and domain of course, and how what program runs 
> what service in Solaris? like netstat -a -p in linux...
> thanks for the help!
>
> regards,
> chris
>
>
> ---------------------------------------------------------------------------
> Attend Black Hat Briefings & Training Federal, September 29-30 (Training), 
> October 1-2 (Briefings) in Tysons Corner, VA; the world's premier 
> technical IT security event.  Modeled after the famous Black Hat event in 
> Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.  
> Symantec is the Diamond sponsor.  Early-bird registration ends September 6.Visit us: www.blackhat.com
> ----------------------------------------------------------------------------



---------------------------------------------------------------------------
Attend Black Hat Briefings & Training Federal, September 29-30 (Training), 
October 1-2 (Briefings) in Tysons Corner, VA; the world's premier 
technical IT security event.  Modeled after the famous Black Hat event in 
Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.  
Symantec is the Diamond sponsor.  Early-bird registration ends September 6.Visit us: www.blackhat.com
----------------------------------------------------------------------------