topic Re: quick question about pwgr in Operating System - HP-UX

quick question about pwgr

Ken Penland_1 — Wed, 08 Sep 2004 13:37:36 GMT

Okay, I might already know the answer to this question, but want to run it by the experts first to confirm.

To help secure our HPs, we have implemented several suggestions listed in the "How to create a Bastion Host" doc found all over the net, in it, it reads:

pwgrd is a password and group caching daemon. Since we have a very small password and group file it is unnecessary. Also, a little detective work with lsof and tusc (Trace Unix System Calls) [12] shows us that it listens on a Unix domain socket for client requests, and we don't want to allow command channels like that to processes running as root, so we have additional incentive to disable it:

Set the PWGR environment variable to 0 in /etc/rc.config.d/pwgr:

PWGR=0

We also remove stale sockets which will prevent unnecessary libc socket creation and requests to a nonexistent pwgrd listener:

# rm /var/spool/pwgr/* # really just need to remove status
# rm /var/spool/sockets/pwgr/*

which we did about a year ago...no problems..however, I have noticed that everytime a user logs on, a new socket is created in /var/spool/sockets/pwgr even though the daemon is not running. why is this? My thoughts are that possibly some other daemon creates the socket here for pwgr to use if needed, if that is the case, is there a way to turn that off as well?

Re: quick question about pwgr

Robert-Jan Goossens_1 — Wed, 08 Sep 2004 16:12:07 GMT

Hi Ken,

Check this doc.

Document description: How To Prevent Creation of Files in /var/spool/sockets/pwgr
Document id: KBRC00012276

http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000068401720

When the libc calls find this directory (/var/spool/sockets/pwgr) , they
will create the socket files in preparation for using the pwgrd server daemon, whether pwgrd is running or not.

remove the directory pwgr from /var/spool/sockets.

More detailed info in above link.

Best regards,
Robert-Jan

Re: quick question about pwgr

Ken Penland_1 — Thu, 09 Sep 2004 07:27:12 GMT

perfect, that is what I was suspecting, thanks for the confirmation!