topic Re: inetd.conf service removal in Operating System - HP-UX

inetd.conf service removal

Ian Little — Fri, 30 Jan 2004 05:47:11 GMT

Hi,

I have been commenting out services that are not required and I am left with the following entries:-

rpc stream tcp swait root /usr/dt/bin/rpc.ttdbserver 100083 1 /usr/dt/bin/rpc.ttdbserver

dtspc stream tcp nowait root /usr/dt/bin/dtspcd /usr/dt/bin/dtspcd

rpc dgram udp wait root /usr/dt/bin/rpc.cmsd 100068 2-5 rpc.cmsd

recserv stream tcp nowait root /usr/lbin/recserv recserv -display :0

spc stream tcp nowait root /usr/bms/bin/softspcd /usr/bms/bin/softspcd

We do not use CDE but we do have the Omniback GUI, Glance and NFS. Am I safe to switch them off?

Thanks,

Simon.

Re: inetd.conf service removal

Alex Glennie — Fri, 30 Jan 2004 06:09:29 GMT

Well 4 of those are CDE related services ... I *think* you'll be OK fyi ....

dtspcd The user will not be able to execute CDE remote actions from this machine to a machine with this service.

rpc.cmsd The user will not be able to view or modify the CDE calendar files on this machine.

rpc.ttdbserver The network aware locking feature of dtmail will not work. This is an optional mechanism for ensuring that the user's dtmail folder is locked when necessary

softspcd I beleive is related to Softbench and or VUE ... is this product installed ? Is this a 10.20 box ?

Recserv is connected with HP's sharedX product - the SharedX Receiver Service

Re: inetd.conf service removal

Ian Little — Fri, 30 Jan 2004 06:18:12 GMT

Hi,

Yes it is a 10.20 box. Softbench is installed but we do not use it. So it looks like we are OK to switch off these services.

Thanks,

Simon.

Re: inetd.conf service removal

Jeroen Peereboom — Fri, 30 Jan 2004 08:46:30 GMT

Simon,

as far as I understand there MAY be other applications using ttdbserver. But 'they' could never explain top me what it is and how I can tell if an application is using it.

JP.

Re: inetd.conf service removal

Steven E. Protter — Fri, 30 Jan 2004 08:52:51 GMT

In the end,you will have to test this configuration. It appears more secure. If you don't want to use CDE you should be fine.

Alos, 10.20 is out of support. Think upgrade if this system does production work.

SEP

Re: inetd.conf service removal

Ian Little — Fri, 30 Jan 2004 09:42:29 GMT

Hi,

I have commented out all of the services and everything seems to be OK. Omniback and Glance work as expected.

If anybody knows about rpc.ttdbserver being used by some other applications then please let me know.

We are in the process of replacing our 10.2 machines, just awaiting the customer go ahead! You can still get support on 10.2 if you pay.

Thanks,

Simon.

Re: inetd.conf service removal

Doug Burton — Sat, 31 Jan 2004 18:36:10 GMT

I'm not sure how much help this is going to be but I've been trying to get (basically) the same info for a long time. Very hard to get. What I have is here:

http://home.tampabay.rr.com/batcave/inetd_conf.htm

Re: inetd.conf service removal

Mic V. — Sat, 31 Jan 2004 20:02:39 GMT

Ian,

Interesting, that you can get 10.20 support for $$$. I figured as much.

What I did (first with 10.20, later with 11.11) was comment them out. CDE *was* in use on this system, but not the calendar manager (uses rpc.cmsd). I think what I ended up with was allowing 127.0.0.1 for rpc.ttdbserver in /var/adm/inetd.sec but the others (listed above) were turned off. It worked just fine (it was my desktop D350, I definitely would have noticed problems :).

Mic

Re: inetd.conf service removal

Steven E. Protter — Sat, 31 Jan 2004 20:07:57 GMT

The rpc (remote process call i think) from Sun are not in heavy use today. They do present a security hazard because under some circumstances they allow users to run commands without authentication.

As far as NFS, CDE, Glance and NFS shutting this down will not present a problem.

SEP

Re: inetd.conf service removal

Bill Hassell — Sat, 31 Jan 2004 22:05:06 GMT

CDE uses Xwindows but it is *not* required to run Xwinodw applications. CDE is a desktop manager, that is, it takes over your entire display and gives you lots of toys to play with. If all you want is to run xterm or the Omniback (or Oracle) GUI, you don't need CDE at all. Turn off all the CDE services in inetd.conf (all daemons that are in /usr/dt.bin) plus CDE startup in /etc/rc.config.d/desktop. Change the line:

DESKTOP=CDE # run dtlogin

to

DESKTOP= # don't run dtlogin

And if dtlogin is running right now -- hit:

UNIX95= ps -C dtlogin

run this command:

/sbin/init.d/dtlogin.rc stop

Then to verify that Xwindow programs still work fine, start your Xterminal emulator and then run xclock (/usr/bin/X11/xclock). You can do the same with theOmniback GUI.