Default services on Cisco Switches

[machaleshamsundar]

Hi Experts,

I wanted to know the default services running on Cisco switches.

Is there any way by which i can identify the services running on cisco switch.

Thanks in advance.

[massimiliano.serafino]

Hi,

You can issue:

show processes

With this command you can see all the processes running.

I hope this helps.

Best regards.

Massimiliano.

[machaleshamsundar]

Hi,

Thanks for your reply, but my requirement is to harden the switch so i want to stop unwanted services like finger service, tcp-small-servers etc.

Regards

Shamundar

[Joseph W. Doherty]

If the switch is supported by "Cisco Router and Security Device Manager (SDM)", it suggests (and can implement) security configuration modifications. (NB: There's a newer recently released renamed version of this package, by I don't recall what it's called.)

You could also examine the various documents Cisco has on the subject, e.g. http://www.cisco.com/en/US/netsol/ns744/networking_solutions_program_home.html

[royalblues]

You can also look at the IOS Auto-secure command (joseph, not sure whether u were reffering to the same thing)

http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123_1/ftatosec.htm#wp1027177

Narayan

[Joseph W. Doherty]

Narayan, no I'm referring to running SDM or the newer Cisco Configuration Professional (the name I couldn't recall in my previous post), externally. (Auto-secure is a good suggestion too.)

[michael.leblanc]

If the goal is to harden the switch, then consider using an audit tool.

The following site has benchmarks for Cisco devices etc., that can help you evaluate the security of your configurations.

http://www.cisecurity.org/

I have not explored these particular benchmarks yet, but they appear to be worth pursuing.

Might take a look at Nipper as well:

http://sourceforge.net/projects/nipper

They will identify services that are running, but should be shutdown to improve your security posture.

[padramas]

Hello Shamsundar,

If the switch is atleast configured with one ip address, the following command "" sh ip sockets ""will list the default services that switch will listen on. however, it will not accept the packets destined to that port unless appropriate configuration is done for those services.

NOTE: The above command will list only udp sockets and to view active TCP connections, you need to use "sh tcp brief "

This links gives general guidelines to harden Cisco devices running IOS

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080120f48.shtml

HTH

Padmanabhan