topic Re: Perfview and inetd.conf services in Operating System - HP-UX

Perfview and inetd.conf services

Bolek Mynarski — Fri, 16 Nov 2001 15:31:58 GMT

I am trying to secure my HP-UX systems so I started by doing the obvious: turning off all unnecessary services in inetd.conf file. However, after doing so, perfview stops working. My question is, which services in inetd.conf are used by perfview?

Thanks.

Re: Perfview and inetd.conf services

Ian Dennison_1 — Fri, 16 Nov 2001 15:38:08 GMT

Check /etc/services for PV*; I found 'pvserver' and 'pvalarm' (382 and 383).

Cheers, Ian

Re: Perfview and inetd.conf services

harry d brown jr — Fri, 16 Nov 2001 15:42:20 GMT

If you are securing a WEB server, then you should not open up any ports, but this means you will have to find an alternative method, say tape backups to move the perfview data.

Are you following these docs?:

http://people.hp.se/stevesk/bastion.html

live free or die
harry

Re: Perfview and inetd.conf services

Roger Baptiste — Fri, 16 Nov 2001 15:44:23 GMT

<>

Obviously, some were not so unnecessary ;-)
The first suspects would be rpc* related services. Reenable them are restart inetd.

Is Measureware running on the system?
mwa status -?
Restart measureware.

Also run #perfstat and see what the status is.

If error persists, pls post the error message.

HTH
raj

Re: Perfview and inetd.conf services

harry d brown jr — Fri, 16 Nov 2001 15:49:12 GMT

When MeasureWare Agent is sending alarms to PerfView, the protocol used to connect to port 135 on the PerfView system was changed from UDP to TCP, regardless of the version of PerfView. If you previously had MeasureWare Agent communicating to PerfView through a firewall, port 135/UDP was open in the firewall. This must be changed in the firewall configuration to open port 135/TCP.

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B4967-90033/B4967-90033_top.html&con=/hpux/onlinedocs/B4967-90033/00/00/5-con.html&toc=/hpux/onlinedocs/B4967-90033/00/00/5-toc.html&searchterms=perview&queryid=20011116-074943

By default, MeasureWare Agent uses dynamically allocated socket port numbers for interprocess communication. To communicate through a packetfiltering network firewall, you must configure the MeasureWare Agent servers
to use statically defined port numbers.

http://docs.hp.com/hpux/pdf/B4967-90044.pdf

live free or die
harry

Re: Perfview and inetd.conf services

Bolek Mynarski — Fri, 16 Nov 2001 15:52:26 GMT

Hi RajMan,

That was the first thing I did. Of course, after doing it, re-reading inetd.conf and restarting measureware, it came back on line but which of rpc services it's using? What I have are these:

-rpc xti tcp
-rpc dgram udp
-recserv stream tcp
-registrar stream tcp

From the previous post, it appears that it uses TCP protocol, so I guess, I can rule rpc dgram udp out. If that's the case, the only rpc service left would be xti. It's too bad that there is no comment in inetd.conf saying that this service is used by pefview (or for that matter in a documentation. But to be fair, I wasn't looking too hard).

P.S. I have also noticed that if you disable ident, perfview will stop working too...

Re: Perfview and inetd.conf services

Roger Baptiste — Fri, 16 Nov 2001 15:55:54 GMT

hi,

To figure out what services it is using, you can do

Before starting the application (perfview here)
do netstat -a >/tmp/netstat.before

Start the application and then
do netstat -a >/tmp/netstat.after

and check the difference to see which ports are being used.
Also, you can trace the processes through glance and see what Files(ports) it has opened.

HTH
raj