Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I installed an OpenBSD 5.2 using "-* & +etc* & +base* & +bsd".

After finished with the install, I rebooted, then netstat -at | grep LISTEN, this is what I get for output:

partial netstat output

Why does so many unneeded services running on the most secure OS (*stated to be the most secure) in the world?

Can someone tell my why are these:

egrep -i '^time|^daytime|^ident|comsat' /etc/inetd.conf
    ident          stream  tcp     nowait  _identd /usr/libexec/identd     identd -el
    ident          stream  tcp6    nowait  _identd /usr/libexec/identd     identd -el
    127.0.0.1:comsat dgram udp     wait    root    /usr/libexec/comsat     comsat
    [::1]:comsat   dgram   udp6    wait    root    /usr/libexec/comsat     comsat
    daytime                stream  tcp     nowait  root    internal
    daytime                stream  tcp6    nowait  root    internal
    time           stream  tcp     nowait  root    internal
    time           stream  tcp6    nowait  root    internal
    daytime        dgram   udp     wait    root    internal
    daytime        dgram   udp6    wait    root    internal
    time           dgram   udp     wait    root    internal
    time           dgram   udp6    wait    root    internal

important in the default install to be enabled?

UPDATE: from the obsd mailing list:

frantisek holop's answer is the most logical yet:

---------
hi,

i seem to recall reading in some RFC or maybe in
one of the stevens books that these services are
required for a "server".  i look at it as being
a good internet neighbour, a bit like "can you tell
me the time please" when someone stops you on the street...
---------
share|improve this question
    
I asked this in the OpenBSD misc mailing list too. –  gasko peter Jan 4 '13 at 7:44
    
Ok, please transpose answer here, if any! –  F. Hauri Jan 7 '13 at 14:18
    
I added an "UPDATE" to my question. –  gasko peter Jan 7 '13 at 15:44
add comment

3 Answers

Take a look at this article all that is wrong. Basically secure by default means at time of release, the system has been audited and is believe to not have any vulnerabilities.

As any other system after a installation, there is the need to harden the OS. comment/remove unneeded services.

Hope this is what you are looking for.

share|improve this answer
2  
No. This article isn't saying that OpenBSD must be hardened by removing services. Quite the opposite, in fact: the problem with OpenBSD is that you need to install additional software to make it useful. –  Gilles Jan 3 '13 at 23:00
1  
@Gilles Ok, answer could be improved, more argumented. But at all this is right: As you won't let your watch in a safe, while is more useful to keep it at your body than risk exist that they will be stolen! This services are strongly eprouved, from a long while. If this could be a risk, I don't think they will be enabled by default –  F. Hauri Jan 7 '13 at 14:16
add comment

The article recommended by Alexandre is a crap. If you want read the article, please read also the comments from some OpenBSD developers.

Probably the services enabled in your system are ntpd, sendmail and ssh. Sendmail is used for to receive the output of the daily security checks. You can disable sshd and ntpd in the installation. Also ntpd doesn't listen outside of localhost by default. The firewall only have the port of ssh open.

share|improve this answer
    
we all know that ntpd is a crap when seeing it from design view. why does an ntp client needs to listen on a port? freakingly unnecessary and violates the KISS principle. –  gasko peter Jan 4 '13 at 7:17
    
SSH wasn't mentioned in my question. –  gasko peter Jan 4 '13 at 7:19
    
I never understand why does LOCAL THING NEED A MAIL SERVER to deliver an output to a directory... again.. violating the KISS principle: en.wikipedia.org/wiki/KISS_principle –  gasko peter Jan 4 '13 at 7:23
    
it's not the firewalls job to limit a service (I mean that what interface it listens..) –  gasko peter Jan 4 '13 at 7:24
add comment
up vote 2 down vote accepted

Theo de Raadt (founder of the OpenBSD project) answer via mail:

Because that is how it is.

If you want an operating system without network services, go find an old copy of MS-DOS.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.