Subject: Re: tightening control on socket bind()ing
To: None <tech-security@netbsd.org>
From: Simon J. Gerraty <sjg@quick.com.au>
List: tech-security
Date: 03/10/1999 15:09:43
>4. use the solution that FreeBSD use (derived from the OpenBSD
>   solution): prevent a bind if another socket on the same port is
>   bound, irregardless of whether SO_REUSE{ADDR,PORT} is set, if
>   the following is not true:
>	* the new bind() is being done by euid==0, or
>	* the new bind() is of a different euid to the existing socket

>after discussion with a few other people, it appears that `4.' is
>probably the sanest/easiest solution; it requires no code modification
>of existing daemons, and shouldn't affect.

The wording of 4. above is a little confusing.  Suffice to say, if 
I can still hack inetd to bind to a one or more explicit addresses
so that I can run multiple inetds with different config, then it sounds 
good.   Ie. for a long time (before ipfilter was integrated :-) I ran
a minimal config inetd bound to by ppp address only, and a more
complete inetd bound to loopback and ethernet addresses.

--sjg