From owner-freebsd-bugs Mon Jan 7 17:30:10 2002 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 8A4DE37B405 for ; Mon, 7 Jan 2002 17:30:00 -0800 (PST) Received: (from gnats@localhost) by freefall.freebsd.org (8.11.6/8.11.6) id g081U0293994; Mon, 7 Jan 2002 17:30:00 -0800 (PST) (envelope-from gnats) Received: from krusty.e-technik.uni-dortmund.de (krusty.E-Technik.Uni-Dortmund.DE [129.217.163.1]) by hub.freebsd.org (Postfix) with ESMTP id BE81737B400 for ; Mon, 7 Jan 2002 17:22:10 -0800 (PST) Received: from emma1.emma.line.org (krusty.dt.e-technik.uni-dortmund.de [129.217.163.1]) by krusty.e-technik.uni-dortmund.de (Postfix) with ESMTP id 06505A3826 for ; Tue, 8 Jan 2002 02:22:06 +0100 (CET) Received: from freebsd.emma.line.org (freebsd.emma.line.org [192.168.0.4]) by emma1.emma.line.org (Postfix) with ESMTP id 26F3AA200B for ; Tue, 8 Jan 2002 01:48:54 +0100 (CET) Received: by freebsd.emma.line.org (Postfix, from userid 500) id 2124F2D328; Mon, 7 Jan 2002 23:40:55 +0100 (CET) Message-Id: <20020107224055.2124F2D328@freebsd.emma.line.org> Date: Mon, 7 Jan 2002 23:40:55 +0100 (CET) From: Matthias Andree Reply-To: Matthias Andree To: FreeBSD-gnats-submit@freebsd.org X-Send-Pr-Version: 3.113 Subject: bin/33670: default inetd install allows for unlimited resource use Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org >Number: 33670 >Category: bin >Synopsis: default inetd install allows for unlimited resource use >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Jan 07 17:30:00 PST 2002 >Closed-Date: >Last-Modified: >Originator: Matthias Andree >Release: FreeBSD 4.5-PRERELEASE i386 >Organization: >Environment: System: FreeBSD freebsd.emma.line.org 4.5-PRERELEASE FreeBSD 4.5-PRERELEASE #0: Thu Jan 3 16:41:15 CET 2002 root@freebsd.emma.line.org:/usr/src/sys/compile/M2A2 i386 >Description: By default, FreeBSD runs inetd. While the FreeBSD implementation of inetd has an outstanding feature set, regretfully, this is not used to protect a system to the full extent. Daniel J. Bernstein, like him or not, describes an attack on inetd, http://cr.yp.to/docs/inetd.c, which can be refined and used against FreeBSD. However, unlike many other inetd implementations, FreeBSD's HAS the ability to limit the total number of connections per service, by means of the -c option, but this is not currently used. >How-To-Repeat: Connect, but do not release, connections just below the maximum connect/minute rate. >Fix: I'm not sure if it's sufficient, but it looks as though changing inetd_flags in /etc/defaults/rc.conf to "-wWc20" might help, no more than 20 servers per service could be running at the same time. >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message