1

I have a Solaris 10 box which has limited tools and commands installed in comparison to Linux distros. In addition, the tools that can be used such as grep and netstat don't have the same options and flags too.

I have some services running on ports that I would like to investigate. As an example, an SSH server running on a port that is not 22. I want to be able to locate the configuration file in order to modify changes (disable weak ciphers etc.). However, when I search the entire file system for sshd.conf - I am only able to find the configuration for the default SSH server on port 22.

Could anyone give me any tips on how I could locate the config file for this unique service. I have already attempted `find / -name "sshd.conf" and other possible variations but with no success.

The next approach I would like to try is using tools such as netstat and svcs. I can tell that the service is running with nmap -p 5555 [ip] and also ssh [ip] -p 5555. I can also see the service is listening with netstat -an | grep "5555". However, I am unable to match it to a service listed in svcs -a. If I were able to match it with a service in svcs -a and then use svcs -x [FMRI] (for more details) - it doesn't give me the config file from where parameters are being read from - only the log file.

So TL;DR: How can I locate a service's configuration file if I know the FMRI or can't map the service to an FMRI. Perhaps more simply, how can I use the output of netstat and identify what the actual service is that is listening on the device? I would imagine this would be asked often for security audits and such.

0

In this case you could man sshd

That would tell you:

 -f configuration_file

     Specifies  the  name  of  the  configuration  file.  The
     default  is  /etc/ssh/sshd_config. sshd refuses to start
     if there is no configuration file.

And if you look at /etc/ssh/sshd_config you'll see the configuration.

You can also do man sshd_config to see what other options are available.

In general, the XML source for services are in /var/svc/manifest. The ssh one is /var/svc/manifest/network/ssh.xml. You can view the current setting with svccfg export ssh.

  • Thanks, but the trouble with man sshd is that it only points to the ssh server at port 22 and not port 5555. However, the /var/svc/manifest is a new suggestion which I hope will return some positive results. One gripe with that though is that I only know that the port is running because of netstat and nmap - it doesn't actually tell me the name of the service - so in essence, my problem is /var/svc/manifest/network/???.xml - although perhaps I could grep for the port number in this directory? @Stephen Harris – George Pascal Sep 21 '16 at 20:33
  • If you have an sshd process that's not using the standard config then it should show up in ps -ef and show the -f flag or the -p flag or similar. Remember that not all processes may be started directly from svcs - an sshd could have been started manually or another non-standard process started (eg a java based ssh daemon). – Stephen Harris Sep 21 '16 at 20:36
  • Thank you, I'll try the things you suggested and I'll have a look into non-standard processes too. Thanks again for your input – George Pascal Sep 21 '16 at 20:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.