Front cover - IBM Redbooks

390 Lotus Security Handbook
change; therefore – as an added security measure – it can be mounted as
read-only.
► /var partition: This partition stores system logs and data services such as
mail, Web, databases, printing, running services, package management, and
so forth. If only one separate partition is created from /, /var is the one that
should be created separately.
► /usr/local directory (the /opt directory in Solaris): These directories often
contain locally-installed optional software, configuration files, and data. The
/usr/local directory is normally not affected by operating system upgrades.
Depending on how these directories are used by the UNIX system, they too
can be mounted as read-only.
The details vary in different UNIX versions (and GNU/Linux distributions) so we
recommend that you read the installation notes that come with the version of
UNIX to be installed to determine the best manner to install them with proper
security in mind.
9.4.3 Disabling the extraneous inetd service
The inetd service is the UNIX “Super Internet Server.” It is basically a daemon
process that is invoked at boot time and reads in a flat configuration file that is
normally found at /etc/inetd.conf.
The inetd service listens for incoming connections on the defined IP ports. When
a connection is initiated on a defined port, it invokes a pre-configured program to
service the request. After the connection is finished, the process invoked to
service that request terminates. The original reason for designing this service in
this manner was to lighten the load and resources required on the IT system.
There are a number of services enabled through inetd, and almost all of them
should be disabled as part of a properly hardened server. Besides normally
disabling FTP, TFTP, Telnet, and the Berkeley r* commands, the following
should be disabled:
► The in.named service: This is the BIND name services daemon. Except for
servers that are specifically defined as being the DNS servers of the
organizations, DNS should not be running on a hardened UNIX server.
► The in.fingerd service: This is the finger daemon that can be used to show
user information and lists of users who are logged in. On a properly hardened
UNIX server, there is no reason to advertise that information that could be of
help to would-be attackers.
► The daytime service: This is the service that displays the date and time on the
system in a string format. Do not permit would-be attackers to get the date
and time of the system, as it is useful for them to implement replay attacks.