Re: local telnetd DoS

[corrupt () SHELLX TICAL NET (Ray Barnes)]

On Fri, 10 Sep 1999, George wrote:

> What this does is get the telnetd service kicked out by inetd..by using a
> similar method with numerous rapid connections, you can shut-down any tcp
> service running under inetd, ie. ftpd, identd, etc, just by connecting to
> the port each service is listening on. Until a fix is out, it might be
> wise to crontab a HUP to inetd every few minutes, so that if somebody
> takes out your telnet service, you can log back in eventually.
>
> George

Sounds like a good "best practice."  I've found that a cron'ed HUP of
inetd every 5 minutes is a must-have in the case of Slackware 3.2 with no
packet filtering.  It's been my experience that smurf attacks seem to lock
up my inetd (tested on two boxes).  Don't ask me why a smurf would have
that effect ; perhaps some sort of odd interaction with the kernel?
*shrug*  In any event, a timed HUP is always helpful, at least in my
case.

Ray Barnes
Tical Network Solutions, Inc.