Date: Tue, 10 Oct 2000 12:54:45 -0400 From: Garance A Drosihn <drosih@rpi.edu> To: Robert Watson <rwatson@FreeBSD.ORG>, Kris Kennaway <kris@citusc.usc.edu> Cc: Terry Lambert <tlambert@primenet.com>, arch@FreeBSD.ORG, Poul-Henning Kamp <phk@critter.freebsd.dk>, Matt Dillon <dillon@earth.backplane.com>, Warner Losh <imp@village.org>, Jeroen Ruigrok van der Werven <jruigrok@via-net-works.nl> Subject: Re: cvs commit: src/etc inetd.conf Message-ID: <v04210107b608f7631a5e@[128.113.24.47]> In-Reply-To: <Pine.NEB.3.96L.1001010095155.90573M-100000@fledge.watson.org> References: <Pine.NEB.3.96L.1001010095155.90573M-100000@fledge.watson.org>
next in thread | previous in thread | raw e-mail | index | archive | help
At 11:54 AM -0400 10/10/00, Robert Watson wrote: >On Mon, 9 Oct 2000, Kris Kennaway wrote: > > > On Tue, Oct 10, 2000 at 02:11:11AM +0000, Terry Lambert wrote: > > > > > > Do any committers have any objections to me disabling > > > > > > ntalk, finger, telnet, rsh, and ftp by default in > > > > > > -current? And sandboxing 'named' by default in -current? > > > > > > Won't this make it difficult to bootstrap a headless 1U box? > > > > The point, which many people in this discussion somehow keep missing, > > is that when you do a default installation of recent versions of > > FreeBSD, the machine reboots with ssh enabled and working. > >As I pointed out earlier, there needs to be a way for the administrator >to securely retrieve the SSH key so that they can log in securely. >Otherwise the whole point of using SSH is lost. If they just blindly >accept the key without some sort of confirmation, it might as well be >telnet. Well, I don't agree with that. It isn't perfect, but it is not the same as a telnet session. On the other hand, I HAVE had new installs where sshd did NOT come up, for whatever reason, and if that had happened on a headless machine then I'd really like to have telnet as an option. Yes, I'm sure we will never again have a bug in the setup of sshd, but it couldn't hurt to wait until after we have a longer track record with it. But let's ignore my opinions for the moment, and let me offer a solution to this thread. We don't seem to have everyone agreeing that it would be good to disable telnetd by default. So, how about we disable everything BUT telnetd? To provide some improvement in security, change /root/.cshrc so that it checks for telnetd being enabled, and writes a message to the console anytime root logs in while telnetd is enabled. People who don't want telnetd at all will see that message, and will remember to disable it from /etc/inet.conf. People who do want telnetd will swear about how obnoxious the message is, and delete that check from /root/.cshrc (or some other appropriate place). We can then leave things that way until some future point, where everyone is more comfortable with telnet being disabled in the default install. Could everyone agree that as a good change to make for now? Would everyone agree that all the other proposed changes (including the sandboxing of named) would be a good idea? --- Garance Alistair Drosehn = gad@eclipse.acs.rpi.edu Senior Systems Programmer or drosih@rpi.edu Rensselaer Polytechnic Institute To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-arch" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?v04210107b608f7631a5e>