proposal: disable most of /rc/bin/services/tcp* by default

proposal: disable most of /rc/bin/services/tcp* by default

[sl]

Why are so many services enabled by default?

I propose to disable the following in the default install by moving
them from tcp* to !tcp*.  Functionality can be enabled by simply
copying !tcp* back to tcp* (and following whatever other procedures
were already required).

Let's turn these off:

	tcp110	# pop3
	tcp143	# imap
	tcp21	# ftp
	tcp23	# telnet
	tcp25	# smtp
	tcp53	# dns
	tcp513	# rlogind
	tcp993	# imap over tls
	tcp995	# pop3 over tls

In addition: Items that are left enabled by default (and really, even
the ones disabled by default) should be checked to ensure that the
installer creates the log files they attempt to write to.

I volunteer to do this if no one objects.

sl

Re: [9front] proposal: disable most of /rc/bin/services/tcp* by default

[cinap_lenrek]

tricky todo as /rc/bin/service is tracked by hg. so when you do this,
you will shoot down services from the net as they run sysupdate.

all these services require authentication (except dns), and they
run as none initially. tho i see your point, this is not 1995.

--
cinap

Re: [9front] proposal: disable most of /rc/bin/services/tcp* by default

[Kurt H Maier]

Quoting cinap_lenrek@felloff.net:

> tricky todo as /rc/bin/service is tracked by hg. so when you do this,
> you will shoot down services from the net as they run sysupdate.

Perhaps the files in /rc/bin/service can be renamed/disabled as part of
the installer?  That wouldn't nuke existing installs, but would provide
sane defaults going forward.

khm

Re: [9front] proposal: disable most of /rc/bin/services/tcp* by default

[mischief]

[-- Attachment #1: Type: text/plain, Size: 916 bytes --]

I am in favor of this and also putting the service directory in .hgignore. Creation of log files would be nice too.

On May 20, 2015 11:16:35 AM PDT, sl@9front.org wrote:
>Why are so many services enabled by default?
>
>I propose to disable the following in the default install by moving
>them from tcp* to !tcp*.  Functionality can be enabled by simply
>copying !tcp* back to tcp* (and following whatever other procedures
>were already required).
>
>Let's turn these off:
>
>	tcp110	# pop3
>	tcp143	# imap
>	tcp21	# ftp
>	tcp23	# telnet
>	tcp25	# smtp
>	tcp53	# dns
>	tcp513	# rlogind
>	tcp993	# imap over tls
>	tcp995	# pop3 over tls
>
>In addition: Items that are left enabled by default (and really, even
>the ones disabled by default) should be checked to ensure that the
>installer creates the log files they attempt to write to.
>
>I volunteer to do this if no one objects.
>
>sl

[-- Attachment #2: Type: text/html, Size: 1242 bytes --]

Re: [9front] proposal: disable most of /rc/bin/services/tcp* by default

[cinap_lenrek]

i'm not against this, but what exactly is the problem? its not like
these services are usable unless you have an actual account on the 
auth server (and created a mailbox for the user in case of imap/pop3).

this is not like unix where services run as "root" and then impersonate
some user on the system, but they start as "none" and cant do anything
(even if there are bugs) unless the user authenticates.

if you have an account, then you can as well cpu in and run commands.

what we really want is a authorization scheme that would allow us to
grant a user the services he can use on the system. right now its
a all or nothing. if you have an account you can use every service
in the network.

--
cinap

Re: [9front] proposal: disable most of /rc/bin/services/tcp* by default

[Kurt H Maier]

Quoting cinap_lenrek@felloff.net:

> i'm not against this, but what exactly is the problem?

Open ports attract automated attacks. Even if they don't work,
bandwidth costs money.

khm

Re: [9front] proposal: disable most of /rc/bin/services/tcp* by default

[cinap_lenrek]

ok, that makes sense.

--
cinap

Re: [9front] proposal: disable most of /rc/bin/services/tcp* by default

[arisawa]

Hello 9front users,

currently I don’t use /rc/bin/service/* at all.
I think services are different among servers.
how do you resolve this problem?

Kenji Arisawa

> 2015/05/21 3:16、sl@9front.org のメール：
> 
> Why are so many services enabled by default?
> 
> I propose to disable the following in the default install by moving
> them from tcp* to !tcp*.  Functionality can be enabled by simply
> copying !tcp* back to tcp* (and following whatever other procedures
> were already required).
> 
> Let's turn these off:
> 
> 	tcp110	# pop3
> 	tcp143	# imap
> 	tcp21	# ftp
> 	tcp23	# telnet
> 	tcp25	# smtp
> 	tcp53	# dns
> 	tcp513	# rlogind
> 	tcp993	# imap over tls
> 	tcp995	# pop3 over tls
> 
> In addition: Items that are left enabled by default (and really, even
> the ones disabled by default) should be checked to ensure that the
> installer creates the log files they attempt to write to.
> 
> I volunteer to do this if no one objects.
> 
> sl