Internet Accessible QOTD Service

The QOTD service response to a TCP connection

An internet accessible QOTD service will, without regard to the input to port 17/TCP during the connection process, respond with a short message or quote. The QOTD service closes the connection after sending the quote. The data flow over the connection is limited by the normal TCP flow control mechanisms. The data received during the TCP connection process is discarded.

The QOTD service response to a UDP connection

An internet accessible QOTD service will, without regard to the input to port 17/UDP during the connection process, respond with a datagram that contains the message or quote of the day. The QOTD service will send one datagram in response of each datagram it receives. The data received during the UDP connection process is discarded.

Port Numbers and Ranges

In TCP/IP and UDP networks, a port is an endpoint to a logical connection and the way a client program specifies a specific server program on a computer in a network. The port number identifies what type of port it is. There are a total of 65,536 (0-65535) possible port numbers. The port numbers are divided into ranges:-

Well-Known Ports (0-1023)

These ports, also called low-numbered ports, are assigned by the Internet Assigned Numbers Authority (IANA). Port numbers within this range are associated with well-known services. These services include the Echo Protocol, the Discard Protocol, the Active Users Protocol, the Daytime Protocol, the Character Generator (CHARGEN) Protocol and the Quote of the Day (QOTD) Protocol. Most operating systems restrict the association (called binding) of any service with these ports to trusted processes, such as root.

Registered ports (1024-49151)

These ports are not assigned by the IANA, but for convenience to the community, the IANA lists the registered uses to these ports. These ports are not considered "trusted" because, in most operating systems, ordinary users may establish an association with any of these port numbers.

Dynamic and Private Ports (49152-65535)

These ports are not assigned or registered. There are no commonly known ports in this space.

Verification

To establish if a host has an Internet accessible service, simple utility programs or tools included with the standard Linux/Ubuntu distribution can be utilised. The test should not be run on the host itself or from the local network, instead it should be run from a different node on the Internet.

Nmap - (Network Mapper) - (https://nmap.org)

To confirm an Internet accessible QOTD service, the 'Nmap' open source network scanner utility program can be utilised.

Nmap is used to discover hosts and services on a computer network by sending packets and analysing the responses.

Insert the IP address of the host you wish to check for an Internet accessible QOTD service when invoking the 'Nmap' open source network scanner utility program together with the options included in the following example.

$ sudo nmap -sU -PN -p17-oG - xxx.xxx.xxx.xxx

An Internet accessible QOTD service listening on port 17/UDP will return information similar to that shown below:

$ sudo nmap -sU -p17 -oG - xxx.xxx.xxx.xxx

# Nmap 7.80 scan initiated Wed Aug 4 15:38:21 2021 as: nmap -sU -p17 -oG - xxx.xxx.xxx.xxx

Host: xxx.xxx.xxx.xxx ()	Status: Up

Host: xxx.xxx.xxx.xxx ()	Ports: 17/open/udp//qotd///

# Nmap done at Wed Aug 4 15:38:21 2021 -- 1 IP address (1 host up) scanned in 0.54 seconds

Options

sudo	:Elevated privileges are required to access raw sockets.

-sU 	:UDP Scan.

-p	:Only scan specified port.

-oG -	:Grepable Output.

Telnet - (https://datatracker.ietf.org/doc/html/rfc854)

To establish a connection to an internet accessible QOTD service, and elicit a response, the 'telenet' internet protocol can be used.

The 'telnet' (Teletype Network) internet protocol first developed in 1969 and defined in RFC 855 in May 1983, is a protocol that provides a command line interface for communication with a remote device or server using the TCP protocol. UDP connectivity can not be tested using Telnet.

Note: Telnet is not a secure protocol and is unencrypted. In a Telnet session, data is conveyed in plain text.

Insert the IP address of the host that has an Internet accessible QOTD service, together with the port number 17.

$ telnet [Host] [Port]

An Internet accessible QOTD service listening on port 17/TCP will return information similar to that shown below:

$ telnet xxx.xxx.xxx.xxx 17

Trying xxx.xxx.xxx.xxx...

Connected to xxx.xxx.xxx.xxx.

Escape character is '^]'.

"We have no more right to consume happiness without producing it than to

Connection closed by foreign host.it." George Bernard Shaw (1856-1950)

If telnet is invoked with a host argument, it performs an open command implicity.

Options

Host	:IP Address of host.

Port  	:Port Number (17).

Solution

If the QOTD Service is not required, disable it.

If the QOTD Service is required, restrict access to trusted clients or specific IP addresses by blocking incoming connections to port 17/TCP and 17/UDP on the firewall.

To disable the QOTD service on:-

Unix/Linux Systems.

1.	Navigate to the file /etc/inetd.conf (or equivalent - /etc/xinetd.d) file.

2.	Stop the inetd service - /etc/init.d/inetd stop

3.	With an editor, open the inetd file and locate the line that controls the Q0TD daemon.

4.	Insert a hash symbol (#) at the beginging of the line, to comment out the QOTD daemon.

5.	Save and exit from the file.

4.	Restart /etc/inetd/ (or equivalent - /etc/xinetd.d) service - /etc/init.d/inetd restart.

Microsoft Windows Systems.

The QOTD service is not inherent to Microsoft Windows, however in the event that the service has been installed, the following steps will render it inoperative.

Set the following registry keys to 0:

HKLM\System\CurrentControlSet\Services\SimpTCP\Parameters\EnableTcpQotd HKLM\System\CurrentControlSet\Services\SimpTCP\Parameters\EnableUdpQotd

1.	In Microsoft Windows, open the registry editor.

2.	Navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SimpTcp\Parameters.

3.	Double-click the EnableTcpQotd key to display the DWORD Editor.

4.	Replace the value in the data field with 0.

5.	Click OK.

	Repeat these steps for:-

	HKLM\System\CurrentControlSet\Services\SimpTCP\Parameters\EnableUdpQotd

For the changes made to the registry to take effect, the Simple TCP/IP Service has to be stopped and restarted.

1.	Launch cmd.exe and execute the following commands.

2.	net stop simptcp.

3.	net start simptcp.

Supplementary Information