I stopped MiniSSDPD, will something bad happen?

Question

I have been trying to harden my Debian system by stopping and disabling the 20 or so unnecessary services listening by default. One of them is called "minissdpd". Apparently this provides "discovery" services to plug-and-play devices, whatever that means. Seems kind of crazy to me that something intended to help local peripherals needs to be listening to Chinese hackers on the other side of the world. What does discovery services even mean?

I looked in some vulnerability database, and sure enough minissdpd had a whole slew of vulnerabilities listed. How can they have this enabled in the default distribution? Seriously, its like install Debian, get hacked.

Anyway, my main question is: now that I have disabled this service, is something bad going to happen (like plug something in and it won't work)?

Answer 1

I would say there's no issue with disabling this service, assuming you have no need for UPnP (Universal Plug and Play). This is a service which allows for devices to "auto discover" one another on your network and advertise services that they can either provide or are looking for to consume.

• http://miniupnp.free.fr/minissdpd.html

excerpt

I first coded MiniSSDPd as a small daemon used by MiniUPnPc (a UPnP control point for IGD devices) to speed up device discoveries. MiniSSDPd keep memory of all UPnP devices that announced themselves on the network through SSDP NOTIFY packets.

More recently, some MiniUPnPd (an implementation of a UPnP IDG) users complained about the non-possibility to run MiniUPnPd and MediaTomb (an implementation of a UPnP Media Server) on the same computer because these two piece of software needed to open UDP port 1900. I then added to MiniSSDPd the ability to handle all SSDP traffic recieved on a computer via the multicast group 239.255.255.250:1900. You may be interested in reading this forum thread about all this.

Answer 2

As explained by @slm, it is probably not needed, so:

systemctl stop minissdpd
systemctl disable minissdpd

Answer 3

my main question is: now that I have disabled this service, is something bad going to happen (like plug something in and it won't work)?

Hello Tyler & all :) In summary, MiniSSDPd is optional. Either deactivating it or fully removing it, would not break anything.

The device discoveries will still work fine. But they might be slower though. If you deactivate or remove MiniSSDPd your Debian would have stronger security. So it depends on your needs.

---

Below is the same answer as above. But with details if you're interested in those.

Speaking for myself only. I do NOT trust MiniSSDPd. Because it has a very weak security history. Catastrophically weak security history in fact. Find the examples & sources below. I deactivated my MiniSSDPd. Because to me security is more important than speed.

The good news is that starting with Debian 10 Buster. MiniSSDPd is deactivated by default.

For those not familiar with MiniSSDPd, in summary what it does is that it speeds up device discoveries. For example, if you plug a new device on your Debian, it will be detected faster. The challenge with MiniSSDPd is that, for example, routers, printers, and other devices can be remotely commandeered by a new attack that exploits a security flaw in the Universal Plug and Play network protocol. And MiniSSDPd has a very long history of weak security.

Examples of security flaws with MiniSSDPd:

• June 2020 https://arstechnica.com/information-technology/2020/06/upnp-flaw-exposes-millions-of-network-devices-to-attacks-over-the-internet/

___• https://archive.md/28Y6i

• October 2019 https://www.howtogeek.com/122487/htg-explains-is-upnp-a-security-risk/

___• https://archive.md/3Bnh0

• May 2019 https://www.debian.org/lts/security/2019/dla-1805.en.html

• May 2016 https://www.debian.org/lts/security/2016/dla-454.en.html

• January 2013 https://www.hdm.io/writing/SecurityFlawsUPnP.pdf

___• https://web.archive.org/web/20200927005146/https://www.hdm.io/writing/SecurityFlawsUPnP.pdf