topic Re: Disabling rlogin will affect service guard? in Operating System - HP-UX

Disabling rlogin will affect service guard?

Lashin — Tue, 15 Feb 2011 06:52:23 GMT

hi,
I have 2 node cluster running ServiceGuard A.11.16.00 on hpux11.23.

I need to disable rlogin on both nodes for fixing security vulnerability suggested by auditors.

I can see .rhost file present on both nodes that will accept rlogin for root user from any nodes.
# cat .rhosts
+
#

there is no /etc/cmcluster/cmnodelist on both nodes

will it make any impact on service guard if i disable rlogin ?

Re: Disabling rlogin will affect service guard?

Kannandgl_1 — Tue, 15 Feb 2011 07:17:42 GMT

Dear ,

The same case in our security team requested disable rlogin and remote shell exe.. etc ..last week i did its not affecting. before make changes plase take bakup of /etc/cmcluster/package file ..

Note : After i disabled the /etc/init.d services for rlogin.

Regards

Re: Disabling rlogin will affect service guard?

Duncan Edmonstone — Tue, 15 Feb 2011 07:31:04 GMT

Just make sure that the DNS names of all the interfaces on both systems are listed in cmclnodelist

So for example if you have 2 hosts called nodeA and nodeB, and they have additional interfaces called nodeA-hb, nodeB-hb (hearbeat LAN) , and interfaces called nodeA-bu and nodeB-bu (backup LAN), then you would want the following in cmclnodelist :

nodeA root
nodeA-hb root
nodeA-bu root
nodeB root
nodeB-hb root
nodeB-bu root

HTH

Duncan

Re: Disabling rlogin will affect service guard?

Lashin — Tue, 15 Feb 2011 09:08:12 GMT

Hi Duncan,

I dont have /etc/cmcluster/cmnodelist file on both nodes.

Re: Disabling rlogin will affect service guard?

Duncan Edmonstone — Tue, 15 Feb 2011 09:32:03 GMT

Just create it - it's only a text file.

HTH

Duncan

Re: Disabling rlogin will affect service guard?

Lashin — Tue, 15 Feb 2011 11:40:43 GMT

Hi Duncan,

I understand that /etc/cmcluster/cmnodelist or .rhost file is used only when we apply a clusture configuration. A running cluster or packages do not read /etc/cmcluster/cmnodelist or .rhost file to login to other cluster nodes...Please correct me if i am wrong..

Re: Disabling rlogin will affect service guard?

Duncan Edmonstone — Tue, 15 Feb 2011 11:58:03 GMT

Yes IIRC that's the case, but I wouldn't want to be fiddling around creating it when I actually have changes to make. Better to put it in place now.

HTH

Duncan

Re: Disabling rlogin will affect service guard?

Emil Velez — Tue, 15 Feb 2011 23:46:23 GMT

some of the serviceguard commands will not work without a cmclnodelist

create it. It should not be a problem.

Re: Disabling rlogin will affect service guard?

Bill Hassell — Wed, 16 Feb 2011 00:28:04 GMT

>> # cat .rhosts
>> +

This is the worst possible content for root's .rhosts file on any system. It essentially says:

Trash my system, there is no security here!

If you need rlogin/remsh/rcp between two computers, put *only* those computer names and user login names in the .rhosts file. Putting + in there is the same as removing the password for root.