SUMMARY: disabling /dev/nit

From: Rob Weltman (
Date: Wed Mar 09 1994 - 18:10:33 CST

My question:

> Open Systems Today, in its February 21 issue, advises removing support for
> /dev/nit in SunOS 4.1.x by reconfiguring the kernel, to disallow promiscuous
> mode and stave off eavesdroppers. Any tips on how to do this? If it matters,
> the machine is a SUN 4/330.

  Many respondents were kind enough to pass on to me the CERT advisory from
February 3 on "Ongoing Network Monitoring Attacks". Others pointed me to the
relevant section of the kernel config file. The advisory contains specifics
on the problems as well as what to do about them. To disable /dev/nit, you
comment out the following lines in your kernel configuration file
(/usr/kvm/sys/sun{4,4c}/conf/MYKERNEL, if your kernel is named MYKERNEL):

pseudo-device snit # streams NIT
pseudo-device pf # packet filter
pseudo-device nbuf # NIT buffering module


# config MYKERNEL
# cd ../MYKERNEL
# make
# mv /vmunix /vmunix.old
# cp vmunix /vmunix

and reboot. Other comments mentioned that an intruder clever enough to have
gained root access to the system (which you need to set the interface in
promiscuous mode) can configure back the system for /dev/nit and reboot it;
that seems to me like a hard one to pull off without people noticing, at
least if the machine is an NFS server. I suppose you could have a cron job
periodically check for the existence of /dev/nit (or check if the interface
is in promiscuous mode).

Thanks to:

Casper Dik <>
Dave Fetrow <>
Gary Blumenstein <>
Gustavo Vegas <titan!>
John T Wilson <>
Kelvin Hui <>
Kevin Cosgrove <qiclab!solomon!kevinc>
Michael Myers <>
Rich Schultz <>
Steve Elliott <>
Steve Simmons <> (Adam Fox) (Dr. Dave Checketts) (Colin Johnson) (Bruce Cogan)
fmrco!ocean!tom@uunet.UU.NET (Tom Yen) (Glenn Satchell - Uniq Professional Services) (Julian Dryden) (Todd LeRoy) (Mark Zawalykut) (Paul B. Henninger)
root@rjrt.COM (0000-Admin(0000))
stern@sunrise.East.Sun.COM (Hal Stern - NE Area Systems Engineer) (Tim Evans) (Jeff Wade 552-5117) (Walt Klingenberg)


| Rob Weltman |
| Microguild, Inc. (415)-428-3693 |
| 888 Villa Street, suite 500 fax (415)-428-3696 |
| Mountain View, CA 94041 |

This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:08:57 CDT