Title

Inetd or xinetd logging/tracing must be enabled. (Cat III impact)

Discussion

Inetd or xinetd logging and tracing allows the system administrators to observe the IP addresses connecting to their machines and to observe what network services are being sought. This provides valuable information when trying to find the source of malicious users and potential malicious users.

Check Content

Verify the default value of the inet service property tcp_trace. # inetadm -p |grep tcp_trace If the tcp_trace inet service property is not set or is set to FALSE, this is a finding. Verify that all enabled inetd-managed processes have the tcp_trace inet service property set to the default value or TRUE. # inetadm | grep enabled | awk '{print $NF}' | xargs inetadm -l | more If any enabled inetd-managed processes have the tcp_trace inet service property set to FALSE, this is a finding.

Fix Text

Enable logging or tracing for inetd. Procedure: # inetadm -M tcp_trace=TRUE Set the tcp_trace inet service property to the default for all enabled inetd-managed services. # inetadm | grep enabled | awk '{print $NF}' | xargs -I X inetadm -m X tcp_trace= (Note: The trailing '=' instructs inetd to use the default value for tcp_trace.)

Additional Identifiers

Rule ID: SV-227820r603266_rule

Vulnerability ID: V-227820

Group Title: SRG-OS-000041

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.