Security hardening hpux 11.23 itanium

[TTr]

> when i run the process as root it works, when i run it as oracle i get an error 'Failed to link libclntsh.so.10.1'..

If you ran this as root, it probably has created the library file(s) in the oracle directory tree that are owned by root. So if you run this process again as the oracle user, it will fail because it can not write over any files that are owned by root.

Check the owner and permissions of
$ORACLE_HOME/lib/libclntsh*
$ORACLE_HOME/lib32/libclntsh*
or use a find command to find root owned files in the entire oracle installation directory.

Check in the oracle directory tree for any files that are owned by root and have a date stamp from the time you ran this process as root.

> i have a second server (backup server) where this linking process works as the user oracle

If you did not run this process as root on this second server, my above claim makes even more sense. (Don't run it as root)

[James R. Ferguson]

Hi Donald:

> what does the swverify -F \* verify the ownership and permissions against ???

It examines the IPD (Installed Product Database) or the contents of the '/var/adm/sw/products' directory. Therein are 'INFO' files (deeper down) that specify the modes, ownership and mtime attributes associated with the installed files. It is this information that 'swverify' uses to make its comparisons to the actual file attributes.

Regards!

...JRF...

[Dennis Handly]

>I noticed your chown_script_B.ksh only deals with symbolic links (chown -h), whats the downside (if any) of changing the script to do all files in a particular directory

You don't run the generated script, you just compare the scripts. It should do all of the files, including symlinks.

>what does the swverify -F \* verify the ownership and permissions against?

The IPD. Which probably be useless in problems with Oracle. Note the -F will "fix" the permission issues.

[Donald Thaler]

i ran this process:

chown_script_A.sh /etc | chown_script_B.sh > chown.sh

and the only entries in chown.sh are

chown -h entries...i assumed from looking at

chown_script_B.sh (print "chown -h") that it only picked up symbolic links ..

[Dennis Handly]

>the only entries in chown.sh are
chown -h entries...

Yes, you then do this on the other system and compare the chown.sh files. You may have to sort these first:
chown_script_A.sh /etc | chown_script_B.sh | sort -k4,4 > chown.txt

>I assumed from looking at chown_script_B.sh (print "chown -h") that it only picked up symbolic links

No it gets every "file". You also need to use:
chown_script_A.sh /etc | chmod_script_C.sh | sort -k3,3 > chmod.txt

And then compare those.
In your case, you probably need to look at the oracle filesystem, not /etc.

[Sunny123_1]

Hi

The script is OK.Follow Dennis Handly's procedure.

Regards
Sunny

[Donald Thaler]

i'm running this script:
./chown_script_A.ksh /u01/app/oracle/product/10.2.0.4 | ./chmod_apollo.ksh | sort -k4,4 >chmod_oracle_apollo.txt

i must have the syntax wrong because it displays all the files it can't change because they don't exist but nothing is in chmod_oracle_apollo.txt ???

[Donald Thaler]

i just realized that all the files are being rejected as not found... if i run the chmod commands individually i don't get errors ??

[Dennis Handly]

>I must have the syntax wrong because it displays all the files it can't change because they don't exist but nothing is in chmod_oracle_apollo.txt?
>if I run the chmod commands individually

To make it clear, the scripts were originally developed to copy the ownership and permissions from one machine to another.

I'm hijacking the scripts to enable you to do a difference between files on two systems. To do that, you compare the output file chmod_oracle_apollo.txt with one from the other system.

Or you can toss those scripts and just compare this:
find $* -xdev -exec ll -d {} + | awk '{ print $9, $1, $3, $4 }' | sort

>but nothing is in chmod_oracle_apollo.txt?

If there is nothing in that file, then we need to debug the pipeline in stages. Does "chown_script_A.sh /u01/app/oracle/product/10.2.0.4" produce anything?

[Steven E. Protter]

The script might be altering the PATH causing the commands not to be found.

SEP