topic Re: PWGR - Turning off. in Operating System - HP-UX

PWGR - Turning off.

joe_91 — Tue, 23 Nov 2004 09:54:27 GMT

All:

We are getting Flagged (For security reg. permissions)for /var/spool/sockets/pwgr directory on most of the servers.My proposal was to turn OFF this daemon and remove the pwgr directory so that i will not get flagged.
is it a good approach? will it have any impact?

Thanks

Joe

Re: PWGR - Turning off.

Jeff Schussele — Tue, 23 Nov 2004 10:01:12 GMT

Hi Joe,

If you're using NIS or NIS+ then there will be no effect.
If you're not using those then you'll suffer some performance hit - especially if you have lots of logins or any apps are using lots of getpwuid() or getgrname() calls because the pwgrd is a caching routine for these calls.
I would suggest you test this prior to implementation because the impact could range from negligible to severe.

My 2 cents,
Jeff

Re: PWGR - Turning off.

Bill Hassell — Tue, 23 Nov 2004 10:07:52 GMT

Not a problem. Edit /etc/rc.config.d/pwgr and set PWGR=0. pwgrd is a password and group caching daemon to speed up searches when the passwd file is thousands of entries. With a small password and group file it is not necessary. pwgrd listens on a Unix domain socket for client requests, and your security folks won't like having a socket that accepts codes to be processed as root, so it's a good idea to disable it.

Re: PWGR - Turning off.

Thierry Poels_1 — Tue, 23 Nov 2004 10:11:04 GMT

hi,

if you have a relatively small passwd file you can stop the pwgrd daemon.
And if it is not running its cache cannot get corrupted (rarely happen but anyway) ;-)

regards,
Thierry.

Re: PWGR - Turning off.

joe_91 — Tue, 23 Nov 2004 10:13:17 GMT

Bill/Jeff:

Thanks.

I think i am going to Disable it 'coz we run NIS and on other machines we just have very few id's who login (Oracle Boxes)
Ok here are the steps for disabling PWGR.

/sbin/init.d/pwgr stop
Edit the /etc/rc.config.d/pwgr and set it to 0

Next remove the directory /var/spool/sockets/pwgr directory
(because even if i disable it the directory will still be there) So is it ok to rm -r that direcotory?

Are these steps correct? Pl. Confirm

Thanks

Joe.

Re: PWGR - Turning off.

A. Clay Stephenson — Tue, 23 Nov 2004 10:14:21 GMT

It's not a problem to disable it. UNIX boxes ran without passwd and group caching literally for decades before this deamon came along. I doubt you will be able to detect any performance impacts.

Re: PWGR - Turning off.

Jeff Schussele — Tue, 23 Nov 2004 10:18:58 GMT

Yes - those steps sound appropriate.
Be advised that if you do any swverify options that would be looking for the pwgrd fileset/files it would flag an error on the missing items - not a problem but you need to be aware of the possibility.

Rgds,
Jeff

Re: PWGR - Turning off.

joe_91 — Tue, 23 Nov 2004 10:28:24 GMT

Jeff & Team:

Perfect to remove the directory right. Now to get rid of that is there any fileset that we need to swremove?

Thanks

Joe

Re: PWGR - Turning off.

Robert-Jan Goossens — Tue, 23 Nov 2004 10:35:00 GMT

Hi Joe,

No need to remove a fileset, you can remove the directory /var/spool/sockets/pwgr after you disabled the pwgr daemon.

Regards,
Robert-Jan

Re: PWGR - Turning off.

Steven E. Protter — Tue, 23 Nov 2004 10:59:18 GMT

If you want to remove the software.

swremove -i

Find it,
select it,
Action Remove.

It will be gone.

SEP