# Why does time/ident/daytime/comsat run after an OpenBSD 5.2 install?

I installed an OpenBSD 5.2 using "-* & +etc* & +base* & +bsd".

After finished with the install, I rebooted, then netstat -at | grep LISTEN, this is what I get for output:

Why does so many unneeded services running on the most secure OS (*stated to be the most secure) in the world?

Can someone tell my why are these:

egrep -i '^time|^daytime|^ident|comsat' /etc/inetd.conf
ident          stream  tcp     nowait  _identd /usr/libexec/identd     identd -el
ident          stream  tcp6    nowait  _identd /usr/libexec/identd     identd -el
127.0.0.1:comsat dgram udp     wait    root    /usr/libexec/comsat     comsat
[::1]:comsat   dgram   udp6    wait    root    /usr/libexec/comsat     comsat
daytime                stream  tcp     nowait  root    internal
daytime                stream  tcp6    nowait  root    internal
time           stream  tcp     nowait  root    internal
time           stream  tcp6    nowait  root    internal
daytime        dgram   udp     wait    root    internal
daytime        dgram   udp6    wait    root    internal
time           dgram   udp     wait    root    internal
time           dgram   udp6    wait    root    internal


important in the default install to be enabled?

UPDATE: from the obsd mailing list:

frantisek holop's answer is the most logical yet:

---------
hi,

i seem to recall reading in some RFC or maybe in
one of the stevens books that these services are
required for a "server".  i look at it as being
a good internet neighbour, a bit like "can you tell
me the time please" when someone stops you on the street...
---------

-
I asked this in the OpenBSD misc mailing list too. –  gasko peter Jan 4 '13 at 7:44
Ok, please transpose answer here, if any! –  F. Hauri Jan 7 '13 at 14:18
I added an "UPDATE" to my question. –  gasko peter Jan 7 '13 at 15:44

Because that is how it is.

If you want an operating system without network services, go find an old copy of MS-DOS.

-

The article recommended by Alexandre is a crap. If you want read the article, please read also the comments from some OpenBSD developers.

Probably the services enabled in your system are ntpd, sendmail and ssh. Sendmail is used for to receive the output of the daily security checks. You can disable sshd and ntpd in the installation. Also ntpd doesn't listen outside of localhost by default. The firewall only have the port of ssh open.

-
we all know that ntpd is a crap when seeing it from design view. why does an ntp client needs to listen on a port? freakingly unnecessary and violates the KISS principle. –  gasko peter Jan 4 '13 at 7:17
SSH wasn't mentioned in my question. –  gasko peter Jan 4 '13 at 7:19
I never understand why does LOCAL THING NEED A MAIL SERVER to deliver an output to a directory... again.. violating the KISS principle: en.wikipedia.org/wiki/KISS_principle –  gasko peter Jan 4 '13 at 7:23
it's not the firewalls job to limit a service (I mean that what interface it listens..) –  gasko peter Jan 4 '13 at 7:24

Take a look at this article all that is wrong. Basically secure by default means at time of release, the system has been audited and is believe to not have any vulnerabilities.

As any other system after a installation, there is the need to harden the OS. comment/remove unneeded services.

Hope this is what you are looking for.

-
No. This article isn't saying that OpenBSD must be hardened by removing services. Quite the opposite, in fact: the problem with OpenBSD is that you need to install additional software to make it useful. –  Gilles Jan 3 '13 at 23:00
@Gilles Ok, answer could be improved, more argumented. But at all this is right: As you won't let your watch in a safe, while is more useful to keep it at your body than risk exist that they will be stolen! This services are strongly eprouved, from a long while. If this could be a risk, I don't think they will be enabled by default –  F. Hauri Jan 7 '13 at 14:16