Summary of common AIX system services

た入场券 2023-10-05 08:48 46阅读 0赞

The following table lists the more common system services within AIX®. Use this table to recognize a starting point for securing your system.

Before you secure your system, back up all your original configuration files, especially the following:

*  /etc/inetd.conf
 *  /etc/inittab
 *  /etc/rc.nfs
 *  /etc/rc.tcpip

<table> 
 <thead> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:bottom;"> Service </td> 
 <td style="border-color:#e0e0e0;vertical-align:bottom;"> Daemon </td> 
 <td style="border-color:#e0e0e0;vertical-align:bottom;"> Started by </td> 
 <td style="border-color:#e0e0e0;vertical-align:bottom;"> Function </td> 
 <td style="border-color:#e0e0e0;vertical-align:bottom;"> Comments </td> 
 </tr> 
 </thead> 
 <tbody> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/bootps </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> bootp services to diskless clients </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Necessary for Network Installation Management (NIM) and remote booting of systems</li> 
 <li>Works concurrently with tftp</li> 
 <li>Disable in most cases</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/chargen </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> character generator (testing only) </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Available as a TCP and UDP service</li> 
 <li>Provides opportunity for Denial of Service attacks</li> 
 <li>Disable unless you are testing your network</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/cmsd </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> calendar service (as used by CDE) </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Runs as root, therefore a security concern</li> 
 <li>Disable unless you require this service with CDE</li> 
 <li>Disable on back room database servers</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/comsat </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> Notifies incoming electronic mail </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Runs as root, therefore a security concern</li> 
 <li>Seldom required</li> 
 <li>Disable</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/daytime </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> obsolete time service (testing only) </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Runs as root</li> 
 <li>Available as a TCP and UDP service</li> 
 <li>Provides opportunity for a Denial of Service PING attacks</li> 
 <li>Service is obsolete and used for testing only</li> 
 <li>Disable</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/discard </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> /dev/null service (testing only) </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Available as TCP and UDP service</li> 
 <li>Used in Denial of Service Attacks</li> 
 <li>Service is obsolete and used for testing only</li> 
 <li>Disable</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/dtspc </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> CDE Subprocess Control </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>This service is started automatically by the&nbsp;inetd&nbsp;daemon in response to a CDE client requesting a process to be started on the daemon's host. This makes it vulnerable to attacks</li> 
 <li>Disable on back room servers with no CDE</li> 
 <li>CDE might be able to function without this service</li> 
 <li>Disable unless absolutely needed</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/echo </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> etc/inetd.conf </td> 
 <td style="vertical-align:top;"> echo service (testing only) </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Available as UDP and TCP service</li> 
 <li>Could be used in Denial of Service or Smurf attacks</li> 
 <li>Used to echo at someone else to get through a firewall or start a datastorm</li> 
 <li>Disable</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/exec </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> remote execution service </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Runs as root user</li> 
 <li>Requires that you enter a user ID and password, which are passed unprotected</li> 
 <li>This service is highly susceptible to being snooped</li> 
 <li>Disable</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/finger </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> finger peeking at users </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Runs as root user</li> 
 <li>Gives out information about your systems and users</li> 
 <li>Disable</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/ftp </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> file transfer protocol </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Runs as root user</li> 
 <li>User id and password are transferred unprotected, thus allowing them to be snooped</li> 
 <li>Disable this service and use a public domain secure shell suite</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/imap2 </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> Internet Mail Access Protocol </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Ensure that you are using the latest version of this server</li> 
 <li>Only necessary if you are running a mail server. Otherwise, disable</li> 
 <li>User ID and password are passed unprotected</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/klogin </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> Kerberos login </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Enabled if your site uses Kerberos authentication</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/kshell </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> Kerberos shell </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Enabled if your site uses Kerberos authentication</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/login </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> rlogin service </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Susceptible to IP spoofing, DNS spoofing</li> 
 <li>Data, including User IDs and passwords, is passed unprotected</li> 
 <li>Runs as root user</li> 
 <li>Use a secure shell instead of this service</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/netstat </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> reporting of current network status </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Could potentially give network information to hackers if run on your system</li> 
 <li>Disable</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/ntalk </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> Allows users to talk with each other </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Runs as root user</li> 
 <li>Not required on production or back room servers</li> 
 <li>Disable unless absolutely needed</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/pcnfsd </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> PC NFS file services </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Disable service if not currently in use</li> 
 <li>If you need a service similar to this, consider Samba, as the pcnfsd daemon predates Microsoft's release of SMB specifications</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/pop3 </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/linetd.conf </td> 
 <td style="vertical-align:top;"> Post Office Protocol </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>User IDs and passwords are sent unprotected</li> 
 <li>Only needed if your system is a mail server and you have clients who are using applications that only support POP3</li> 
 <li>If your clients use IMAP, use that instead, or use the POP3s service. This service has a Secure Socket Layer (SSL) tunnel</li> 
 <li>Disable if you are not running a mail server or have clients who need POP services</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/rexd </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> remote execution </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Runs as root user</li> 
 <li>Peers with the&nbsp;on&nbsp;command</li> 
 <li>Disable service</li> 
 <li>Use&nbsp;rshand&nbsp;rshd&nbsp;instead</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/quotad </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> reports of file quotas (for NFS clients) </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Only needed if you are running NFS file services</li> 
 <li>Disable this service unless required to provide an answer for the&nbsp;quota&nbsp;command</li> 
 <li>If you need to use this service, keep all patches and fixes for this service up to date</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/rstatd </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> Kernel Statistics Server </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>If you need to monitor systems, use SNMP and disable this service</li> 
 <li>Required for use of the&nbsp;rup&nbsp;command</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/rusersd </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> info about user logged in </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>This is not an essential service. Disable</li> 
 <li>Runs as root user</li> 
 <li>Gives out a list of current users on your system and peers with rusers</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/rwalld </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> write to all users </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Runs as root user</li> 
 <li>If your systems have interactive users, you might need to keep this service</li> 
 <li>If your systems are production or database servers, this is not needed</li> 
 <li>Disable</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/shell </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> rsh service </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Disable this service if possible. Use Secure Shell instead</li> 
 <li>If you must use this service, use the TCP Wrapper to stop spoofing and limit exposures</li> 
 <li>Required for theXhier&nbsp;software ditribution program</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/sprayd </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> RPC spray tests </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Runs as root user</li> 
 <li>Might be required for diagnosis of NFS network problems</li> 
 <li>Disable if you are not running NFS</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/systat </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inted.conf </td> 
 <td style="vertical-align:top;"> "ps -ef" status report </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Allows for remote sites to see the process status on your system</li> 
 <li>This service is disabled by default. You must check periodically to ensure that the service has not been enabled</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/talk </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> establish split screen between 2 users on the net </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Not a required service</li> 
 <li>Used with the&nbsp;talk&nbsp;command</li> 
 <li>Provides UDP service at Port 517</li> 
 <li>Disable unless you need multiple interactive chat sessions for UNIX user</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/ntalk </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> "new talk" establish split screen between 2 users on the net </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Not a required service</li> 
 <li>Used with the&nbsp;talk&nbsp;command</li> 
 <li>Provides UDP service at Port 517</li> 
 <li>Disable unless you need multiple interactive chat sessions for UNIX user</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/telnet </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> telnet service </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Supports remote login sessions, but the password and ID are passed unprotected</li> 
 <li>If possible, disable this service and use Secure Shell for remote access instead</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/tftp </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> trivial file transfer </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Provides UDP service at port 69</li> 
 <li>Runs as root user and might be compromised</li> 
 <li>Used by NIM</li> 
 <li>Disable unless you are using NIM or have to boot a diskless workstation</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/time </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> obsolete time service </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Internal function of&nbsp;inetd&nbsp;that is used by&nbsp;rdate&nbsp;command.</li> 
 <li>Available as TCP and UDP service</li> 
 <li>Sometimes used to synchronize clocks at boot time</li> 
 <li>Service is outdated. Use ntpdate instead</li> 
 <li>Disable this only after you have tested your systems (boot/reboot) with this service disabled and have observed no problems</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/ttdbserver </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> tool-talk database server (for CDE) </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>The&nbsp;rpc.ttdbserverd&nbsp;runs as root user and might be compromised</li> 
 <li>Stated as a required service for CDE, but CDE is able to work without it</li> 
 <li>Should not be run on back room servers or any systems where security is a concern</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inetd/uucp </td> 
 <td style="vertical-align:top;"> inetd </td> 
 <td style="vertical-align:top;"> /etc/inetd.conf </td> 
 <td style="vertical-align:top;"> UUCP network </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Disable unless you have an application that uses UUCP</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inittab/dt </td> 
 <td style="vertical-align:top;"> init </td> 
 <td style="vertical-align:top;"> /etc/rc.dt script in the /etc/inittab </td> 
 <td style="vertical-align:top;"> desktop login to CDE environment </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Starts the X11 server on the console</li> 
 <li>Supports the X11 Display Manager Control Protocol (xdcmp) so that other X11 stations can log into the same machine</li> 
 <li>Service should be used on personal workstations only. Avoid using it for back room systems</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inittab/dt_nogb </td> 
 <td style="vertical-align:top;"> init </td> 
 <td style="vertical-align:top;"> /etc/inittab </td> 
 <td style="vertical-align:top;"> desktop login to CDE environment (NO graphic boot) </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>No graphical display until the system is up fully</li> 
 <li>Same concerns as inittab/dt</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inittab/httpdlite </td> 
 <td style="vertical-align:top;"> init </td> 
 <td style="vertical-align:top;"> /etc/inittab </td> 
 <td style="vertical-align:top;"> web server for the&nbsp;docsearch&nbsp;command </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Default web server for the docsearch engine</li> 
 <li>Disable unless your machine is a documentation server</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inittab/i4ls </td> 
 <td style="vertical-align:top;"> init </td> 
 <td style="vertical-align:top;"> /etc/inittab </td> 
 <td style="vertical-align:top;"> license manager servers </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Enable for development machines</li> 
 <li>Disable for production machines</li> 
 <li>Enable for back room database machines that have license requirements</li> 
 <li>Provides support for compilers, database software, or any other licensed products</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inittab/imqss </td> 
 <td style="vertical-align:top;"> init </td> 
 <td style="vertical-align:top;"> /etc/inittab </td> 
 <td style="vertical-align:top;"> search engine for "docsearch" </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Part of the default web server for the docsearch engine</li> 
 <li>Disable unless your machine is a documentation server</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inittab/lpd </td> 
 <td style="vertical-align:top;"> init </td> 
 <td style="vertical-align:top;"> /etc/inittab </td> 
 <td style="vertical-align:top;"> BSD line printer interface </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Accepts print jobs from other systems</li> 
 <li>You can disable this service and still send jobs to the print server</li> 
 <li>Disable this after you confirm that printing is not affected</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inittab/nfs </td> 
 <td style="vertical-align:top;"> init </td> 
 <td style="vertical-align:top;"> /etc/inittab </td> 
 <td style="vertical-align:top;"> Network File System/Net Information Services </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>NFS and NIS services based which were built on UDP/RPC</li> 
 <li>Authentication is minimal</li> 
 <li>Disable this for back room machines</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inittab/piobe </td> 
 <td style="vertical-align:top;"> init </td> 
 <td style="vertical-align:top;"> /etc/inittab </td> 
 <td style="vertical-align:top;"> printer IO Back End (for printing) </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Handles the scheduling, spooling and printing of jobs submitted by the&nbsp;qdaemon&nbsp;daemon</li> 
 <li>Disable if you are not printing from your system because you are sending print job to a server</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inittab/qdaemon </td> 
 <td style="vertical-align:top;"> init </td> 
 <td style="vertical-align:top;"> /etc/inittab </td> 
 <td style="vertical-align:top;"> queue daemon (for printing </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Submits print jobs to the&nbsp;piobe&nbsp;daemon</li> 
 <li>If you are not printing from your system, then disable</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inittab/uprintfd </td> 
 <td style="vertical-align:top;"> init </td> 
 <td style="vertical-align:top;"> /etc/inittab </td> 
 <td style="vertical-align:top;"> kernel messages </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Generally not required</li> 
 <li>Disable</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inittab/writesrv </td> 
 <td style="vertical-align:top;"> init </td> 
 <td style="vertical-align:top;"> /etc/inittab </td> 
 <td style="vertical-align:top;"> writing notes to ttys </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Only used by interactive UNIX workstation users</li> 
 <li>Disable this service for servers, back room databases, and development machines</li> 
 <li>Enable this service for workstations</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> inittab/xdm </td> 
 <td style="vertical-align:top;"> init </td> 
 <td style="vertical-align:top;"> /etc/inittab </td> 
 <td style="vertical-align:top;"> traditional X11 Display Management </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Do not run on back room production or database servers</li> 
 <li>Do not run on development systems unless X11 display management is needed</li> 
 <li>Acceptable to run on workstations if graphics are needed</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.nfs/automountd </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.nfs </td> 
 <td style="vertical-align:top;"> automatic file systems </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>If you use NFS, enable this for workstations</li> 
 <li>Do not use the automounter for development or back room servers</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.nfs/biod </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.nfs </td> 
 <td style="vertical-align:top;"> Block IO Daemon (required for NFS server) </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Enabled for NFS server only</li> 
 <li>If not an NFS server, then disable this along with nfsd and rpc.mountd</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.nfs/keyserv </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.nfs </td> 
 <td style="vertical-align:top;"> Secure RPC Key server </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Manages the keys required for secure RPC</li> 
 <li>Disable this if you are&nbsp;not&nbsp;using NFS and NIS</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.nfs/nfsd </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.nfs </td> 
 <td style="vertical-align:top;"> NFS Services (required for NFS Server) </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Authentication is weak</li> 
 <li>Can lend itself to stack frame crashing</li> 
 <li>Enable if on NFS file servers</li> 
 <li>If you disable this, then disable&nbsp;biod,&nbsp;nfsd, and&nbsp;rpc.mountd&nbsp;as well</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.nfs/rpc.lockd </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.nfs </td> 
 <td style="vertical-align:top;"> NFS file locks </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Disable if you are not using NFS</li> 
 <li>Disable this if you are not using file locks across the network</li> 
 <li>lockd&nbsp;daemon is mentioned in the SANS Top Ten Security Threats</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.nfs/rpc.mountd </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.nfs </td> 
 <td style="vertical-align:top;"> NFS file mounts (required for NFS Server) </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Authentication is weak</li> 
 <li>Can lend itself to stack frame crashing</li> 
 <li>Should be enabled only on NFS file servers</li> 
 <li>If you disable this, then disable&nbsp;biod&nbsp;and&nbsp;nfsd&nbsp;as well</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.nfs/rpc.statd </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.nfs </td> 
 <td style="vertical-align:top;"> NFS file locks (to recover them) </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Implements file locks across NFS</li> 
 <li>Disable unless you are using NFS</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.nfs/rpc.yppasswdd </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.nfs </td> 
 <td style="vertical-align:top;"> NIS password daemon (for NIS master) </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Used to manipulate the local password file</li> 
 <li>Only required when the machine in question is the NIS master; disable in all other cases</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.nfs/ypupdated </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.nfs </td> 
 <td style="vertical-align:top;"> NIS Update daemon (for NIS slave) </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Receives NIS database maps pushed from the NIS Master</li> 
 <li>Only required when the machine in question is a NIS slave to a Master NIS Server</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/autoconf6 </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> IPv6 interfaces </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Disable unless you are running IP Version 6</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/dhcpcd </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> Dynamic Host Configure Protocol (client ) </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Back room servers should not rely on DHCP. Disable this service</li> 
 <li>If your host is not using DHCP, disable</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/dhcprd </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> Dynamic Host Configure Protocol (relay </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Grabs DHCP broadcasts and sends them to a server on another network</li> 
 <li>Duplicate of a service found on routers</li> 
 <li>Disable this if you are not using DHCP or rely on passing information between networks</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/dhcpsd </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> Dynamic Host Configure Protocol (server </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Answers DHCP requests from clients at boot time; gives client information, such as IP name, number, netmask, router, and broadcast address</li> 
 <li>Disable this if you are not using DHCP</li> 
 <li>Disabled on production and back room servers along with hosts not using DHCP</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/dpid2 </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> outdated SNMP service </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Disable unless you need SNMP</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/gated </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc.rc.tcpip </td> 
 <td style="vertical-align:top;"> gated routing between interfaces </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Emulates router function</li> 
 <li>Disable this service and use RIP or a router instead</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/inetd </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> inetd services </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>A thoroughly secured system should have this disabled, but is often not practical</li> 
 <li>Disabling this will disable remote shell services which are required for some mail and web servers</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/mrouted </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> multi-cast routing </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Emulates router function of sending multi-cast packets between network segments</li> 
 <li>Disable this service. Use a router instead</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/names </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> DNS name server </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Use this only if your machine is a DNS name server</li> 
 <li>Disable for workstation, development and production machines</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/ndp-host </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> IPv6 host </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Disable unless you use IP Version 6</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/ndp-router </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> IPv6 routing </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Disable this unless you use IP Version 6. Consider using a router instead of IP Version 6</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/portmap </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> RPC services </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Required service</li> 
 <li>RPC servers register with&nbsp;portmap&nbsp;daemon. Clients who need to locate RPC services ask the&nbsp;portmap&nbsp;daemon to tell them where a particular service is located</li> 
 <li>Disable only if you have managed to reduce RPC service so that the only one remaining is&nbsp;portmap</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/routed </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> RIP routing between interfaces </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Emulates router function</li> 
 <li>Disable if you have a router for packets between networks</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/rwhod </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> Remote "who" daemon </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Collects and broadcasts data to peer servers on the same network</li> 
 <li>Disable this service</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/sendmail </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> mail services </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Runs as root user</li> 
 <li>Disable this service unless the machine is used as a mail server</li> 
 <li>If disabled, then do one of the following: 
 <ul> 
 <li>Place an entry in crontab to clear the queue. Use the&nbsp;/usr/lib/sendmail -q&nbsp;command</li> 
 <li>Configure DNS services so that the mail for your server is delivered to some other system</li> 
 </ul></li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/snmpd </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> Simple Network Management Protocol </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Disable if you are not monitoring the system via SNMP tools</li> 
 <li>SNMP may be required on critical servers</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/syslogd </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> system log of events </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Disabling this service is&nbsp;not&nbsp;recommended</li> 
 <li>Prone to denial of service attacks</li> 
 <li>Required in any system</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/timed </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> Old Time Daemon </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Disable this service and use xntp instead</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> rc.tcpip/xntpd </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/rc.tcpip </td> 
 <td style="vertical-align:top;"> New Time Daemon </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Keeps clocks on systems in sync</li> 
 <li>Disable this service.</li> 
 <li>Configure other systems as time servers and let other systems synchronize to them with a cron job that calls ntpdate</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> dt login </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /usr/dt/config/Xaccess </td> 
 <td style="vertical-align:top;"> unrestricted CDE </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>If you are not providing CDE login to a group of X11 stations, you can restrict dtlogin to the console.</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> anonymous FTP service </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> user rmuser -p &lt;username&gt; </td> 
 <td style="vertical-align:top;"> anonymous ftp </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Anonymous FTP ability prevents you from tracing FTP usage to a specific user</li> 
 <li>Remove user ftp if that user account exists, as follows:&nbsp;rmuser -p ftp</li> 
 <li>Further security can be obtained by populating the&nbsp;/etc/ftpusers&nbsp;file with a list of those who should not be able to ftp to your system</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> anonymous FTP writes </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> anonymous ftp uploads </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>No file should belong to ftp.</li> 
 <li>FTP anonymous uploads allow the potential for misbehaving code to be placed on your system.</li> 
 <li>Put the names of those users you want to disallow into the&nbsp;/etc/ftpusers&nbsp;file</li> 
 <li>Some examples of system-created users you might want to disallow from anonymously uploading via FTP to your system are: root, daemon, bin.sys, admin.uucp, guest, nobody, lpd, nuucp, ladp</li> 
 <li>Change the owner and group rights to the&nbsp;ftpusers&nbsp;files as follows:&nbsp;chown root:system /etc/ftpusers</li> 
 <li>Change the permissions to the&nbsp;ftpusers&nbsp;files to a stricter setting as follows:&nbsp;chmod 644 /etc/ftpusers</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> ftp.restrict </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> ftp to system accounts </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>No user from the outside should be allowed to replace root files using&nbsp;ftpusers&nbsp;file</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> root.access </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/security/user </td> 
 <td style="vertical-align:top;"> rlogin/telnet to root account </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>Set the rlogin option in the&nbsp;etc/security/user&nbsp;file to false</li> 
 <li>Anyone logging in as root should first log in under their own name and then&nbsp;su&nbsp;to root; this provides an audit trail</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> snmpd.readWrite </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> /etc/snmpd.conf </td> 
 <td style="vertical-align:top;"> SNMP readWrite communities </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>If you are&nbsp;not&nbsp;using SNMP, disable the SNMP daemon.</li> 
 <li>Disable community private and community system in the&nbsp;/etc/snmpd.conf&nbsp;file</li> 
 <li>Restrict 'public' community to those IP addresses that are monitoring your system</li> 
 </ul></td> 
 </tr> 
 <tr> 
 <td style="border-color:#e0e0e0;vertical-align:top;"> syslog.conf </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> &nbsp; </td> 
 <td style="vertical-align:top;"> configure syslogd </td> 
 <td style="vertical-align:top;"> 
 <ul> 
 <li>If you have not configured&nbsp;/etc/syslog.conf, then disable this daemon</li> 
 <li>If you are using&nbsp;syslog.conf&nbsp;to log system messages, then keep enabled</li> 
 </ul></td> 
 </tr> 
 </tbody> 
</table>

**Parent topic:**

[Security][]

[Security]: https://www.ibm.com/support/knowledgecenter/ssw_aix_72/security/security-kickoff.html?view=kc