4

I have been considering replacing Ubuntu with OpenBSD to improve the security on my local server. I need to have ssh access to it, and I also need it to serve static web content - so the only ports I need open are 22 and 80.

However, when I scan my server for open ports after installing OpenBSD 4.8, and enabling ssh and http at /etc/rc.conf

httpd_flags=""
sshd_flags=""

I discovered that it had several other open ports:

Port Scan has started…

Port Scanning host: 192.168.56.102

     Open TCP Port:     13          daytime
     Open TCP Port:     22          ssh
     Open TCP Port:     37          time
     Open TCP Port:     80          http
     Open TCP Port:     113         ident

ssh (22) and http (80) should be open as I enabled httpd and sshd, but why are the other ports open, and should I worry about them creating additional security vulnerabilities? Should they be open in a default installation?

4
  • Maybe the demons are started by your inetd.conf. Did you also check the default settings for rc.conf? Jan 9, 2011 at 21:19
  • I didn't modify the default rc.conf except for adding httpd and sshd.
    – D R
    Jan 9, 2011 at 21:40
  • I think this question illustrates one reason why the entire "What OS is more secure?" thought process is faulty. Jan 10, 2011 at 5:01
  • 6
    Do not alter /etc/rc.conf. Never. Use /etc/rc.conf.local instead. It is explained in the related manual pages.
    – Benoit
    Jan 10, 2011 at 14:16

3 Answers 3

5

Daytime and Time and what I would consider "legacy" protocols. My guess is they are included in the default configuration for traditional UNIX-style completeness. They are started by inetd, and unless you need these services (you probably don't if you have to ask) you can disable them by commenting out the relevant lines in your /etc/inetd.conf (see man page).

#ident           stream  tcp     nowait  _identd /usr/libexec/identd     identd -el
#ident           stream  tcp6    nowait  _identd /usr/libexec/identd     identd -el
#daytime        stream  tcp     nowait  root    internal
#daytime        stream  tcp6    nowait  root    internal
#time           stream  tcp     nowait  root    internal
#time           stream  tcp6    nowait  root    internal

kill -HUP `cat /var/run/inetd.pid`
3

Given that pf is enabled by default you can make your pf.conf use the default deny method. Assume your interface is fxp0, this is a good starting rule set.

set skip on lo0

block in  fxp0
block out fxp0

pass out on fxp0 proto { tcp, udp, icmp } from any to any modulate state

pass in on fxp0 proto tcp from any to (fxp0) {22 80}
2

This question is three years old but I feel it should be answered: they aren't open in the default installation; at least, not anymore.

A port scan on a base installation of OpenBSD 5.5 only shows ssh:

Port Scan has started…

Port Scanning host: 192.168.1.29

     Open TCP Port:     22          ssh
Port Scan has completed…

Enabling httpd and disabling pf with pfctl -d only shows ssh and http:

Port Scan has started…

Port Scanning host: 192.168.1.29

     Open TCP Port:     22          ssh
     Open TCP Port:     80          http
Port Scan has completed…

That isn't to say that they've never been open, they were in previous releases. Whether or not they're a vulnerability is up to the user. The reality is they're very simple daemons that I imagine would be hard to exploit. More answers here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .