Skip to content

Commit 068acb3

Browse files
yyyniniprabhataravind
authored andcommitted
Disabling ports by adding parameter ‘-P 0’ (sonic-net#21296)
Why I did it There are several TCP ports bound to localhost that need to be disabled to enhance system security. Work item tracking Microsoft ADO (number only): How I did it By adding -P 0 in supervisord.conf.j2 to disable the ports. How to verify it Check the file for -P 0 changes, and confirm port behaviour using netstat.
1 parent adae9bf commit 068acb3

File tree

1 file changed

+8
-8
lines changed

1 file changed

+8
-8
lines changed

dockers/docker-fpm-frr/frr/supervisord/supervisord.conf.j2

+8-8
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ stderr_syslog=true
3232
dependent_startup=true
3333

3434
[program:mgmtd]
35-
command=/usr/lib/frr/mgmtd -A 127.0.0.1
35+
command=/usr/lib/frr/mgmtd -A 127.0.0.1 -P 0
3636
priority=4
3737
autostart=false
3838
autorestart=true
@@ -69,7 +69,7 @@ dependent_startup=true
6969
dependent_startup_wait_for=zebra:running
7070

7171
[program:staticd]
72-
command=/usr/lib/frr/staticd -A 127.0.0.1
72+
command=/usr/lib/frr/staticd -A 127.0.0.1 -P 0
7373
priority=4
7474
autostart=false
7575
autorestart=false
@@ -83,7 +83,7 @@ dependent_startup_wait_for=zsocket:exited
8383

8484
{% if DEVICE_METADATA.localhost.frr_mgmt_framework_config is defined and DEVICE_METADATA.localhost.frr_mgmt_framework_config == "true" %}
8585
[program:bfdd]
86-
command=/usr/lib/frr/bfdd -A 127.0.0.1
86+
command=/usr/lib/frr/bfdd -A 127.0.0.1 -P 0
8787
priority=4
8888
stopsignal=KILL
8989
autostart=false
@@ -99,9 +99,9 @@ dependent_startup_wait_for=zebra:running
9999

100100
[program:bgpd]
101101
{% if FEATURE is defined and FEATURE.bmp is defined and FEATURE.bmp.state is defined and FEATURE.bmp.state == "enabled" %}
102-
command=/usr/lib/frr/bgpd -A 127.0.0.1 -M snmp -M bmp
102+
command=/usr/lib/frr/bgpd -A 127.0.0.1 -P 0 -M snmp -M bmp
103103
{% else %}
104-
command=/usr/lib/frr/bgpd -A 127.0.0.1 -M snmp
104+
command=/usr/lib/frr/bgpd -A 127.0.0.1 -P 0 -M snmp
105105
{% endif %}
106106
priority=5
107107
stopsignal=KILL
@@ -117,7 +117,7 @@ dependent_startup_wait_for=zsocket:exited
117117

118118
{% if DEVICE_METADATA.localhost.frr_mgmt_framework_config is defined and DEVICE_METADATA.localhost.frr_mgmt_framework_config == "true" %}
119119
[program:ospfd]
120-
command=/usr/lib/frr/ospfd -A 127.0.0.1 -M snmp
120+
command=/usr/lib/frr/ospfd -A 127.0.0.1 -P 0 -M snmp
121121
priority=5
122122
stopsignal=KILL
123123
autostart=false
@@ -131,7 +131,7 @@ dependent_startup=true
131131
dependent_startup_wait_for=zebra:running
132132

133133
[program:pimd]
134-
command=/usr/lib/frr/pimd -A 127.0.0.1
134+
command=/usr/lib/frr/pimd -A 127.0.0.1 -P 0
135135
priority=5
136136
stopsignal=KILL
137137
autostart=false
@@ -239,7 +239,7 @@ dependent_startup_wait_for=bgpd:running
239239

240240
{% if DEVICE_METADATA.localhost.frr_mgmt_framework_config is defined and DEVICE_METADATA.localhost.frr_mgmt_framework_config == "true" %}
241241
[program:pathd]
242-
command=/usr/lib/frr/pathd -A 127.0.0.1
242+
command=/usr/lib/frr/pathd -A 127.0.0.1 -P 0
243243
priority=5
244244
stopsignal=KILL
245245
autostart=false

0 commit comments

Comments
 (0)