5

I installed an OpenBSD 5.2 using "-* & +etc* & +base* & +bsd".

After finished with the install, I rebooted, then netstat -at | grep LISTEN, this is what I get for output:

partial netstat output

Why does so many unneeded services running on the most secure OS (*stated to be the most secure) in the world?

Can someone tell my why are these: 

egrep -i '^time|^daytime|^ident|comsat' /etc/inetd.conf
    ident          stream  tcp     nowait  _identd /usr/libexec/identd     identd -el
    ident          stream  tcp6    nowait  _identd /usr/libexec/identd     identd -el
    127.0.0.1:comsat dgram udp     wait    root    /usr/libexec/comsat     comsat
    [::1]:comsat   dgram   udp6    wait    root    /usr/libexec/comsat     comsat
    daytime                stream  tcp     nowait  root    internal
    daytime                stream  tcp6    nowait  root    internal
    time           stream  tcp     nowait  root    internal
    time           stream  tcp6    nowait  root    internal
    daytime        dgram   udp     wait    root    internal
    daytime        dgram   udp6    wait    root    internal
    time           dgram   udp     wait    root    internal
    time           dgram   udp6    wait    root    internal

important in the default install to be enabled?

UPDATE: from the obsd mailing list:

frantisek holop's answer is the most logical yet:

---------
hi,

i seem to recall reading in some RFC or maybe in
one of the stevens books that these services are
required for a "server".  i look at it as being
a good internet neighbour, a bit like "can you tell
me the time please" when someone stops you on the street...
---------
Improve this question
3
  • I asked this in the OpenBSD misc mailing list too.
    – gasko peter
    Jan 4, 2013 at 7:44
  • Ok, please transpose answer here, if any!
    – F. Hauri - Give Up GitHub
    Jan 7, 2013 at 14:18
  • I added an "UPDATE" to my question.
    – gasko peter
    Jan 7, 2013 at 15:44

3 Answers 3

Reset to default
2

Theo de Raadt (founder of the OpenBSD project) answer via mail:

Because that is how it is.

If you want an operating system without network services, go find an old copy of MS-DOS.

Improve this answer
1

The article recommended by Alexandre is a crap. If you want read the article, please read also the comments from some OpenBSD developers.

Probably the services enabled in your system are ntpd, sendmail and ssh. Sendmail is used for to receive the output of the daily security checks. You can disable sshd and ntpd in the installation. Also ntpd doesn't listen outside of localhost by default. The firewall only have the port of ssh open.

Improve this answer
4
  • we all know that ntpd is a crap when seeing it from design view. why does an ntp client needs to listen on a port? freakingly unnecessary and violates the KISS principle.
    – gasko peter
    Jan 4, 2013 at 7:17
  • SSH wasn't mentioned in my question.
    – gasko peter
    Jan 4, 2013 at 7:19
  • I never understand why does LOCAL THING NEED A MAIL SERVER to deliver an output to a directory... again.. violating the KISS principle: en.wikipedia.org/wiki/KISS_principle
    – gasko peter
    Jan 4, 2013 at 7:23
  • it's not the firewalls job to limit a service (I mean that what interface it listens..)
    – gasko peter
    Jan 4, 2013 at 7:24
0

Take a look at this article all that is wrong. Basically secure by default means at time of release, the system has been audited and is believe to not have any vulnerabilities.

As any other system after a installation, there is the need to harden the OS. comment/remove unneeded services.

Hope this is what you are looking for.

Improve this answer
2
  • 2
    No. This article isn't saying that OpenBSD must be hardened by removing services. Quite the opposite, in fact: the problem with OpenBSD is that you need to install additional software to make it useful.
    – Gilles 'SO- stop being evil'
    Jan 3, 2013 at 23:00
  • 1
    @Gilles Ok, answer could be improved, more argumented. But at all this is right: As you won't let your watch in a safe, while is more useful to keep it at your body than risk exist that they will be stolen! This services are strongly eprouved, from a long while. If this could be a risk, I don't think they will be enabled by default
    – F. Hauri - Give Up GitHub
    Jan 7, 2013 at 14:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .