topic Re: syslog.log Messages in Operating System - HP-UX

syslog.log Messages

Marty Metras — Tue, 04 Feb 2003 20:02:36 GMT

I'm getting this message in /var/adm/syslog/syslog.log
I'm doing rsync with ssh and sftp and one of them is before and/or after these messages.
These messages repeat 3 - 4 times in a row.
This is and HP-UX 11.0 server.
The data that is being copied/synced looks to be OK.
Can you help me find what is causing this message?

Marty

Feb 2 19:29:09 hostname inetd[29063]: execv /usr/lbin/identd: No such file or directory
Feb 2 19:29:09 hostname inetd[720]: ident/tcp: Exit status 1

Re: syslog.log Messages

Ken Hubnik_2 — Tue, 04 Feb 2003 20:05:29 GMT

What path is in your /etc/inetd.conf file for the ident entry???

Re: syslog.log Messages

Ken Hubnik_2 — Tue, 04 Feb 2003 20:16:04 GMT

Here is the permissions file the file on an 11.11 system.

-r-xr--r-- 1 bin bin 311296 Nov 14 2000 /usr/lbin/identd

Re: syslog.log Messages

Sridhar Bhaskarla — Tue, 04 Feb 2003 20:17:36 GMT

Hi,

identd is mostly used by sendmail and you may not need it. Comment it out in /etc/inetd.conf and refresh inetd (inetd -c).

If you want to keep it, then you should have an executable under /usr/lbin/identd. You can copy it from another system of the same OS.

-Sri

Re: syslog.log Messages

Jordan Bean — Tue, 04 Feb 2003 20:26:59 GMT

Looks to me like the identd binary is missing or not executable... In that case, disable the ident service in inetd... You should disable this anyway since it can be exploited.

I'm not sure this is even related to the use of ssh and rsync... Have you set this up through cron? If so, are you expecting output via e-mail? If so, then I think either the local or a remote sendmail session may be performing the ident lookup.

Re: syslog.log Messages

Marty Metras — Tue, 04 Feb 2003 20:37:33 GMT

Ken,
Here is what in "/etc/identd.conf"
ident stream tcp wait bin /usr/lbin/identd identd
There is no file "/usr/lbin/identd"

Sri,
I do use sendmail.

I have 2 servers doing the same thing.
Neither have "/usr/lbin/identd"
Only one gets the error.
What should be in the "/usr/lbin/identd" file?
I have it one the Redhat Linux boxes. Is it safe to use that copy?

Marty

Re: syslog.log Messages

Jeff Schussele — Tue, 04 Feb 2003 20:43:46 GMT

Hi Marty,

Nope, identd off a RedHat system will definitely NOT work.

Here's what it looks like on my 11.0 system

-r-xr--r-- 1 bin bin 40960 Aug 20 1998 identd

We normally comment it out on all our systems as it has known exploits. And can help a hacker "discover" just what the system is & does. We run sendmail on almost all our servers & commenting it out in /etc/inetd.conf has no affect on a properly configured sendmail server.

Rgds,
Jeff

Re: syslog.log Messages

Marty Metras — Tue, 04 Feb 2003 20:50:56 GMT

Jordan,
The jobs that do the rsync and sftp ate started from cron. These jobs also send mailx messages if they have a problem. These messages are send to the other server using userID which alais sends it to userID@servername this has been working. Not meaning it is right. Looks like those error messages have been in there since at lease Christmas.
Would send mail still work it I remove it from /etc/identd.conf or is this something I could turn off in sendmail some where?
Marty

Re: syslog.log Messages

Marty Metras — Tue, 04 Feb 2003 20:56:20 GMT

How do you answer my questions before I ask them? :-)
From what I'm hearing I should remark out identd in /etc/identd.conf and then restart identd using `identd -c` Right?

Then if all go well then do the same on the other boxes. Linus too?

Marty

Re: syslog.log Messages

Marty Metras — Tue, 04 Feb 2003 20:58:45 GMT

Sorry for the typo. I ment /etc/inetd.conf
Marty

Re: syslog.log Messages

Jeff Schussele — Tue, 04 Feb 2003 21:02:41 GMT

Comment it out in /etc/inetd.conf & restart inetd using

inetd -c

Rgds,
Jeff

Re: syslog.log Messages

Marty Metras — Tue, 04 Feb 2003 21:07:08 GMT

Done.

I'll let you know how it went in an hour or so.
Marty

Re: syslog.log Messages

Jordan Bean — Tue, 04 Feb 2003 21:17:34 GMT

Yep, comment out the ident entry in /etc/inetd.conf and tell inetd to reload the configuration with `inetd -c`.

If you're not at all concerned about having sendmail verify remote host identities, then you can tell sendmail to not perform identd lookups by setting the timeout value to zero. So for all of your sendmail servers, set Timeout.ident=0 in /etc/mail/sendmail.cf (or /etc/sendmail.cf) and restart sendmail. On HP-UX, restart sendmail using:

/sbin/init.d/sendmail stop
/sbin/init.d/sendmail start

On linux, use:

/etc/rc.d/init.d/sendmail restart