From owner-freebsd-ports  Sat Oct  7  4:10: 7 2000
Delivered-To: freebsd-ports@freebsd.org
Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP id 5B9EC37B503
	for <freebsd-ports@FreeBSD.org>; Sat,  7 Oct 2000 04:10:01 -0700 (PDT)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.9.3/8.9.2) id EAA06774;
	Sat, 7 Oct 2000 04:10:01 -0700 (PDT)
	(envelope-from gnats@FreeBSD.org)
Received: from guru.mired.org (okc-27-149-77.mmcable.com [24.27.149.77])
	by hub.freebsd.org (Postfix) with SMTP id 5753237B502
	for <FreeBSD-gnats-submit@freebsd.org>; Sat,  7 Oct 2000 04:02:09 -0700 (PDT)
Received: (qmail 35661 invoked by uid 100); 7 Oct 2000 11:02:03 -0000
Message-Id: <20001007110203.35660.qmail@guru.mired.org>
Date: 7 Oct 2000 11:02:03 -0000
From: mwm@mired.org
Reply-To: mwm@mired.org
To: FreeBSD-gnats-submit@freebsd.org
X-Send-Pr-Version: 3.2
Subject: ports/21814: Inetd's very existence is a security risk.
Sender: owner-freebsd-ports@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org


>Number:         21814
>Category:       ports
>Synopsis:       Inetd's very existence is a security risk.
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-ports
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Sat Oct 07 04:10:00 PDT 2000
>Closed-Date:
>Last-Modified:
>Originator:     Mike Meyer
>Release:        FreeBSD 5.0-CURRENT i386
>Organization:
Meyer Consulting
>Environment:

	A system that's going to be exposed to the internet-at-large,
	and thus needs to be secured.

>Description:

	I always (always, always, always) turn off inetd on any system
	that needs to be secured against exposure to the world. I'd
	really it rather not be on the system *at all*.

>How-To-Repeat:

	"make installworld" on your favorite box that doesn't run
	inetd, and notice that you get a brand, spanking new copy of
	inetd.

>Fix:

	The following patches add a hook to usr.sbin/Makefile to
	optionally disable building inetd, and an appropriate line to
	etc/defaults/make.conf describing the hook.

--- etc/defaults/make.conf-orig	Sat Oct  7 05:18:01 2000
+++ etc/defaults/make.conf	Sat Oct  7 05:18:19 2000
@@ -59,6 +59,7 @@
 #NO_CVS=	true	# do not build CVS
 #NO_BIND=	true	# do not build BIND
 #NO_FORTRAN=	true	# do not build g77 and related libraries
+#NO_INETD=     true    # do not build and install sendmial
 #NO_LPR=	true	# do not build lpr and related programs
 #NO_MAILWRAPPER=true	# do not build the mailwrapper(8) MTA selector
 #NO_MODULES=	true	# do not build modules with the kernel
--- usr.sbin/Makefile-orig	Sat Oct  7 04:23:59 2000
+++ usr.sbin/Makefile	Sat Oct  7 04:24:30 2000
@@ -32,7 +32,6 @@
 	getextattr \
 	gifconfig \
 	ifmcstat \
-	inetd \
 	iostat \
 	ipftest \
 	ipresend \
@@ -130,6 +129,10 @@
 	ndc \
 	nslookup \
 	nsupdate
+.endif
+
+.if !defined(NO_INETD)
+SUBDIR+=inetd
 .endif
 
 .if !defined(NO_LPR)



>Release-Note:
>Audit-Trail:
>Unformatted:


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ports" in the body of the message