Inetd or xinetd logging/tracing must be enabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-1011	GEN003800	SV-27430r1_rule	ECAR-1 ECAR-2 ECAR-3 ECSC-1	Low

Description
Inetd or xinetd logging and tracing allows the system administrators to observe the IP addresses connecting to their machines and to observe what network services are being sought. This provides valuable information when trying to find the source of malicious users and potential malicious users.

STIG	Date
Solaris 10 X86 Security Technical Implementation Guide	2014-01-09

Details

Check Text ( C-28616r2_chk )
Verify the default value of the inet service property tcp_trace. # inetadm -p \|grep tcp_trace If the tcp_trace inet service property is not set or is set to FALSE, this is a finding. Verify that all enabled inetd-managed processes have the tcp_trace inet service property set to the default value or TRUE. # inetadm \| grep enabled \| awk '{print $NF}' \| xargs inetadm -l \| more If any enabled inetd-managed processes have the tcp_trace inet service property set to FALSE, this is a finding.

Check Text ( C-28616r2_chk )

Verify the default value of the inet service property tcp_trace.
# inetadm -p |grep tcp_trace

If the tcp_trace inet service property is not set or is set to FALSE, this is a finding.

Verify that all enabled inetd-managed processes have the tcp_trace inet service property set to the default value or TRUE.
# inetadm | grep enabled | awk '{print $NF}' | xargs inetadm -l | more

If any enabled inetd-managed processes have the tcp_trace inet service property set to FALSE, this is a finding.

Fix Text (F-24701r3_fix)
Enable logging or tracing for inetd. Procedure: # inetadm -M tcp_trace=TRUE Set the tcp_trace inet service property to the default for all enabled inetd-managed services. # inetadm \| grep enabled \| awk '{print $NF}' \| xargs -I X inetadm -m X tcp_trace= (Note: The trailing '=' instructs inetd to use the default value for tcp_trace.)