remsh/rcp umask issues

[K. Lesperance]

Dennis,

those scripts all have the default values, the same as on the working hosts:

root # grep -i umask *
OVTrcSrv: (umask 002; /opt/OV/lbin/xpl/trc/ovtrcd)
clean_adm: mask=`umask`
clean_adm: umask 022
clean_adm: umask $mask
ems: UmaskValue=`umask`
ems: umask u=r,g=r,o=r
ems: umask $UmaskValue
ems: UmaskValue=`umask`
ems: umask u=r,g=r,o=r
ems: umask $UmaskValue
esm:umask 022
gwlmagt:umask 077
hpsmh:umask 002
hpsmh: umask 333
hpsmh: umask 002
inetd: mask=`umask`
inetd: umask 000
inetd: umask $mask
prngd.rc:umask 022
rstemsListener:umask 022
sec_mgmt:umask 077
spc:umask 077
syslog-ng: # Note. This umask is mostly paranoia. syslog-ng
syslog-ng: mask=`umask`
syslog-ng: umask 022 # u=rwx,g=rx,o=rx, disable group/other write
syslog-ng: umask $mask
syslogd: mask=`umask`
syslogd: umask 022
syslogd: umask $mask

inetd.conf has the following for remsh:

shell stream tcp6 nowait root /usr/lbin/remshd remshd

[Per Christensen_1 · Accepted solution]

Hi

Nice one actually.
Apparently remshd on 11.31 does NOT use the UMASK setting i /etc/default/security as it says in man. Only way I can think of to change this behaviour is to make a change to /etc/pam.conf in the section Session Management by adding bypass_umask:

Before:
rcomds session required libpam_hpsec.so.1 bypass_limit_login

After:
rcomds session required libpam_hpsec.so.1 bypass_limit_login bypass_umask

Hope this helps you,
Have a nice Easter everyone.
Cheers
Per

[K. Lesperance]

Pat,

I think you found it!

root # grep -i umask pam.conf
ftp session required libpam_hpsec.so.1 bypass_limit_login bypass_umask bypass_nologin
rcomds session required libpam_hpsec.so.1 bypass_limit_login bypass_umask

Thanks everyone!

[K. Lesperance]

False alarm - one of my colleagues added that in to pam.conf, but it hasn't seemed to help. The umask is set to 077 regardless of whether or not we include "bypass_umask" in pam.conf.

[K. Lesperance]

We've finally found the solution. It appears somebody manually started inetd, instead of using the script in /sbin/inetd. This caused inetd to inherit the umask of the session it was started as. Starting inetd with the init script has caused remsh/rcp to use the correct umask again.

Thanks for all the help.

[K. Lesperance]

Restarted inetd using init script /sbin/init.d/inetd, instead of manually running /usr/sbin/inetd.

[Per Christensen_1]

Hi K.
Great the problems is solved. Do you still have the umask setting in pam.conf ?
My tests showed that was the solution.
Just curious.
Cheers