Re: [gentoo-dev] rlogin & telnet

[Martin Schlemmer]

On Mon, 2002-01-21 at 03:47, Taras wrote:
> On Sun, 2002-01-20 at 15:33, Aron Griffis wrote:
> > Hello Developers,
> >
> > I'm planning to add xinetd snippets for rlogind and telnetd into the
> > netkit ebuilds.  These will install into /etc/xinetd.d, similar to the
> > snippets which already install there.  This seems appropriate to me for
> > a couple reasons:
> >
> > (1) xinetd has external connections disabled by default in
> >     /etc/xinetd.conf.  Therefore this addition doesn't open up security
> >     holes by default.  The system administrator still needs to change
> >     /etc/xinetd.conf (or the appropriate snippet) to allow network
> >     connections to these daemons.
> >
> > (2) xinetd is further disabled by default since it requires the
> >     administrator to inentionally "rc-update add xinetd default".
> >
> > (3) Considering the protection inherent in the system provided by the
> >     policies in (1) and (2), it seems amiss to not supply working
> >     snippets in /etc/xinetd.d for these daemons.  Additionally,
> >     netkit-rsh and netkit-telnet don't install by default, so I think
> >     all the bases are covered.
> >
> > I'll make these changes in the next 24 hours or so unless there is
> > a reasonable objection.
> >
> > Aron
> I would not like that. Since some of us may modify xinetd.conf to run
> public services and having telnet/stuff added could come as a surprise.
> How about adding them as comments, so if one wants them, all that needs
> to be done is uncommenting of a few lines.

I have no problem with Aron's idea, except that you can
disable the snippes themselfs by default.

Underneath is a rsync example:
------------------cut here------------------------
service rsync
{
        disable = yes
        socket_type     = stream
        wait            = no
        user            = root
        server          = /usr/bin/rsync
        server_args     = --daemon
        log_on_failure  += USERID
}
------------------cut here-------------------------

Thus, even if external connections is not disabled in
/etc/xinetd.conf, the snipped will be disabled by default,
and the administrator will just have to change:

  disable = yes

to:

  disable = no

for each snippet to enable them.

This will be much more convenient that writhing your own
snippets.


Greetings,

-- 

Martin Schlemmer
Gentoo Linux Developer, Desktop Team Developer
Cape Town, South Africa