Xinetd, VNC, and TFTP

Steve Grubb sgrubb at redhat.com
Mon Apr 6 19:16:28 UTC 2015


On Monday, April 06, 2015 03:02:20 PM Trevor Vaughan wrote:
> Hi All,
> 
> Since the new-ish (6 and 7) guides indicate that xinetd should be disabled,
> what is the preferred method for running VNC and TFTP sessions to a host?
> 
> The tftp-server package installs the /etc/xinetd.d/tftp file but could
> certainly drop an init script/systemd script with associated sysconfig file.
> 
> The VNC one is a bit more difficult since it gets difficult to have dynamic
> SSH-based terminals without something like xinetd (or, again, a highly
> configurable init script).
> 
> I know this falls under the "if you need it, use it" category 

I'd say this is still the case. Tfpd and vnc are not universally needed. I 
think the aim is to reduce root running daemons (xinetd) in the common use 
case so that the attack surface is smaller. In your situation on RHEL6, 
install xinetd if you need it. In the case of RHEL7, systemd socket activation 
should work (should even be shipped that way).

-Steve


> but I was
> wondering if there were 'more compliant' alternatives that didn't involve
> epic amounts of work and/or maintenance and that stuck within the RHEL
> software stack.
> 
> Thanks,
> 
> Trevor



More information about the scap-security-guide mailing list