Details

This entry starts the sprayd daemon when required. This service is used as a tool to generate UDP packets for testing and diagnosing network problems.

The sprayd service is used as a tool to generate UDP packets for testing and diagnosing network problems. The service must be disabled if you are not running NFS, as it can be used by attackers in a Distributed Denial of Service (DDoS) attack.

Solution

In /etc/inetd.conf, comment out the sprayd entry-

chsubserver -r inetd -C /etc/inetd.conf -d -v ‘sprayd’ -p ‘udp’

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/528

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.

References

• 800-53|CM-7b.
• CSCv6|9.1

Source

• Tenable.com/audits