I stopped MiniSSDPD, will something bad happen?

Question

I have been trying to harden my Debian system by stopping and disabling the 20 or so unnecessary services listening by default. One of them is called "minissdpd". Apparently this provides "discovery" services to plug-and-play devices, whatever that means. Seems kind of crazy to me that something intended to help local peripherals needs to be listening to Chinese hackers on the other side of the world. What does discovery services even mean?

I looked in some vulnerability database, and sure enough minissdpd had a whole slew of vulnerabilities listed. How can they have this enabled in the default distribution? Seriously, its like install Debian, get hacked.

Anyway, my main question is: now that I have disabled this service, is something bad going to happen (like plug something in and it won't work)?

Answer 1

I would say there's no issue with disabling this service, assuming you have no need for UPnP (Universal Plug and Play). This is a service which allows for devices to "auto discover" one another on your network and advertise services that they can either provide or are looking for to consume.

• http://miniupnp.free.fr/minissdpd.html

excerpt

I first coded MiniSSDPd as a small daemon used by MiniUPnPc (a UPnP control point for IGD devices) to speed up device discoveries. MiniSSDPd keep memory of all UPnP devices that announced themselves on the network through SSDP NOTIFY packets.

More recently, some MiniUPnPd (an implementation of a UPnP IDG) users complained about the non-possibility to run MiniUPnPd and MediaTomb (an implementation of a UPnP Media Server) on the same computer because these two piece of software needed to open UDP port 1900. I then added to MiniSSDPd the ability to handle all SSDP traffic recieved on a computer via the multicast group 239.255.255.250:1900. You may be interested in reading this forum thread about all this.