Installed services (UNIX)

Module: Startup Files

This check reports installed services on your system. The check parses the /etc/inetd.conf or xinetd.conf file for all services found in that file. On Solaris 10, the check uses the inetadm command to list the services. The check looks at Services template records to identify forbidden processes. Services that are defined as Ignored in the Services template are not reported when found. Services that are defined as Optional are reported when the mandatory parameter is not found or the forbidden parameter is found.

The following table lists the error messages for the check.

Table: Error messages for Installed services

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: STKU_INSTALLED_SERVICES

Category: Policy Compliance

UNIX (5858)

Title: Installed services

Description:This is a list of currently installed services that are defined in the file /etc/inetd.conf or xinetd.conf. These services have been defined with specific sets of data to execute on your system.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: STKU_NOTEMPLATES

Category: Policy Compliance

UNIX (5848)

Title: No template files specified

Description:No templates were found. Templates allow a much greater control over what is monitored on your system. By not having templates, you have no way of determining what should or should not be running on your system.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: STKU_FORBIDDEN_PARAMETER_FOUND

Category: Policy Compliance

UNIX (5852)

Title: Forbidden parameter

Description:ESM found a forbidden parameter running with a system-owned process on the agent. The parameter was defined as forbidden in the Services template. You should terminate the process because it may be causing security problems or damaging your system.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Forbidden parameter: %s; found parameter: %s; process: %s; found template: %s; comment: %s]

String ID: STKU_MANDATORY_PARAMETER_NOT_FOUND

Category: Policy Compliance

UNIX (5853)

Title: Mandatory parameter not found

Description:ESM found that a Mandatory parameter was not running with a system- owned process on the agent. Since the parameter was defined as Mandatory in your Services template, this could indicate a security problem. You should review all listed processes for problems.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Mandatory parameter: %s; process: %s; template: %s; comment: %s]

String ID: STKU_FORBIDDEN_PROCESS_FOUND

Category: Policy Compliance

UNIX (5850)

Title: Forbidden process found

Description:A system-owned process that is defined as Forbidden in the Services template is running on the agent. You should terminate the process because it may be causing security problems or damaging your system.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Template: %s; comment: %s]

String ID: STKU_MANDATORY_PROCESS_NOT_FOUND

Category: Policy Compliance

UNIX (5851)

Title: Mandatory process not found

Description:ESM found that a system-owned process set to Mandatory in the Services template is not running on the agent. This could indicate a security problem. You should review all listed processes for problems.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [Template: %s; comment: %s]