Subject: Re: inetd.conf defaults
To: Erik Fair <fair@clock.org>
From: Bill Sommerfeld <sommerfeld@orchard.arlington.ma.us>
List: tech-net
Date: 05/28/2000 08:33:18
Many security penetrations occur because systems run services which
the administrator that the administrator was unaware of.

I think we should ship with an inetd.conf with every service initially
commented out.  The two remaining services (telnet and ftp) accept
plaintext passwords, which are flagrantly insecure in many/most
configurations.

If I hear no substantive objections, I'll make this change and request
a pullup to -release.

Once the crypto-* mess is straightened out, we can change this to:
	- give telnetd command line arguments to require
	  encryption and authentication
	- give ftpd a command line argument to require either
	  anonymous access or encrypted/authenticated access.

but for now it's safer to just turn them off and let people decide
what's safe in their environments.

					- Bill