Security hardening hpux 11.23 itanium

[Donald Thaler]

their is an oracle process genlcntsh which creates a file called libclntsh.so.10.1. this file is critical to the linking process for the oracle binaries. when i run the process as root it works, when i run it as oracle i get an error 'Failed to link libclntsh.so.10.1'..
oracle says this points in the direction of 'security hardening', evidently some module has the wrong read/write/access permission.

i have a second server (backup server) where this linking process works as the user oracle.

how does one go about comparing the access rights on the files between two servers ??

[Steven Schweda]

"ls -l"?
"lsacl"?

[Dennis Handly · Accepted solution]

>how does one go about comparing the access rights on the files between two servers?

You could use my scripts in the following thread and then compare the generated output script.
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1215123

[Donald Thaler]

swverify -F\* returns illegal option -- * ??

[Steven E. Protter]

Shalom,

swverify \*

Not what you wrote.

/sbin/init.d/swagentd -r

Try again.

Compare permissions of the libclntsh.so.10.1. library on the good system to the bad and make corrections and try again.

Look at the oracle install logs for other issues.

Check the environment of the install user on both systems for variations.

SEP

[Dennis Handly]

>swverify -F\* returns illegal option -- *

You need a space between -F and \*.
(You might want to leave out the -F first as SEP suggests.)

[Donald Thaler]

dennis... i noticed your chown_script_B.ksh only deals with symbolic links (chown -h), whats the downside (if any) of changing the script to do all files in a particular directory

[Donald Thaler]

what exactly does swverify -F \* do ??

[Steven E. Protter]

Shalom,

No impact to changing ownership on soft links.

Like to see that script.

Try the swverify both ways, my way first then Dennis. If the results are not too verbose post them.



SEP

[Donald Thaler]

steven to see dennis's script go to:
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1215123

what does the swverify -F \* verify the ownership and permissions against ???