server inaccessible via telnet (rc.config.d garbage)

[Matti_Kurkela]

> ./rctest[6]: Syntax error at line 6 : `{' is not matched.

This error message refers to line 6 of the rctest script. It's the line that sources (reads) the /etc/rc.config.d/SnmpMaster file. So the error indicates there is a problem in the file the rctest script is currently reading (i.e. the SnmpMaster file) but unfortunately does not identify the exact line within that file.

On line 97 of the SnmpMaster script is the opening curly brace of the StartMasterAgent() function. It does not seem to have a corresponding closing curly brace. It looks like someone has (somewhat inexpertly) modified the StartMasterAgent function to start the HP Internet Express Net-SNMP agent instead of the standard HP-UX OV SNMP agent.

The minimal fix might be to add a closing curly brace to line 101.

[meekrob]

Thanks MK for your opinion, i will try to search within that file.

If i replace the  /etc/rc.config.d/SnmpMaster    by  the  /usr/newconfig/etc/rc.config.d/SnmpMaster   and after that i rename it, is this going to train more problems? 

Thanks in advance

[Dennis Handly]

>It is clear that the /etc/rc.config.d/SnmpMaster file's size is weird,

If you look at the file contents, it says it is really /sbin/init.d/SnmpMaster!  This is the script that will process the config file above.

But it seems there are lines in this script that have been modified, causing your error.

>we are investigating if someone brought some modifications to this file without our knowledge.

Can you check the directory modification dates of /etc/rc.config.d?

Also, take a diff with that config file and /sbin/init.d/SnmpMaster.

>If I replace the /etc/rc.config.d/SnmpMaster by the /usr/newconfig/etc/rc.config.d/SnmpMaster, is this going to cause more problems?

Not any more than you have now.   ;-)  It is useless as it is.

Do you have a back up of SnmpMaster?  Otherwise, did you ever enable SnmpMaster?

(Do you have an old rc.log in your backups?)

>It looks like someone has (somewhat inexpertly) modified the StartMasterAgent function

And put the file into the wrong place.  :-(

[meekrob]

Many Thanks for your opinion, but could you clarify more plz?

> If you look at the file contents, it says it is really /sbin/init.d/SnmpMaster!  This is the script that will process the config file above.

You mean that  the /sbin/init.d/SnmpMaster  is the script that is having syntax error and not the  /etc/rc.config.d/SnmpMaster file?

>Can you check the directory modification dates of /etc/rc.config.d?

kindly find attached corresponding output.

>Otherwise, did you ever enable SnmpMaster?  (Do you have an old rc.log in your backups?)

It's a backup server that each dept can use, how can i find if someone enabled SnmpMaster? As for an older rc.log  i will try to post the output of an older one stored in /etc/rc.log.old  

>And put the file into the wrong place.

Could you clarify more regarding this upper point of view? I really need to know what happens indeed.

In conclusion, what can be the best solution to re-enable inetd? with less problems on the server?

Thanks in advance

[Bill Hassell]

Your server has been down for many days because of this error. Rather than try to find the bad code added by another root user, make an archive directory, move the Snmp files into old and recover the original files from /usr/newconfig/etc/rc.config.d, like this:

umask 022
cd /etc/rc.config.d
mkdir old
mv Snmp* old
cp -p /usr/newconfig/etc/rc.config.d/Snmp* .

 and then reboot. Although the most recent changes to rc.config.d were back in November, these changes were probably made without a reboot so all the changed files in November are suspect. Snmp programs are used primarily for monitoring so your system will at least boot and run. As for finding out why the files were changed and whether Snmp is required, you need to look at your change control documents. If changes are made in secret and root users do not write down what they have done, then you'll just have to muddle along and wait for someone to ask that Snmp be enabled. I suspect that this will not happen since the Snmp config scripts haven't worked since they were changed last November.

[Dennis Handly]

>You mean that the /sbin/init.d/SnmpMaster is the script that is having syntax error and not the /etc/rc.config.d/SnmpMaster file?

Not quite.  I meant a copy of  /sbin/init.d/SnmpMaster was changed then moved to
/etc/rc.config.d/SnmpMaster.

>>Can you check the directory modification dates of /etc/rc.config.d?

>kindly find attached corresponding output.

Sorry, directory modification date.  Not files.  You need to add a -d.

>It's a backup server that each dept can use, how can I find if someone enabled SnmpMaster?

The size changed back in Nov.  Has the system been up that long until recently?

>I will try to post the output of an older one stored in /etc/rc.log.old

That's not likely to be old enough.  You want one old enough to cover the last time it booted successfully.

>Could you clarify more regarding this point of view?

Someone edited the rc script (/sbin/init.d) and put it into the config (rc.config.d) directory.

>what can be the best solution to re-enable inetd?

Copy /usr/newconfig/etc/rc.config.d/SnmpMaster there.

I'd also be suspicious of these other modifications:

2206 Nov 16 11:10 SnmpHpunix

2272 Nov 16 11:18 SnmpMib2

>move the Snmp files into old and recover the original files from /usr/newconfig/etc/rc.config.d

Right.

[meekrob]

Hello All,

we lately found that this behavior is occurring after each accidental restart of the server.

The new issue that we are facing is when adding a new printer to the server. We already had old printers configured on the server but right now and when adding a new one, we are getting the below output:

HP-UX unknown B.11.31 U ia64 (td)

Please wait...checking for disk quotas

(c)Copyright 1983-2006 Hewlett-Packard Development Company, L.P.

(c)Copyright 1979, 1980, 1983, 1985-1993 The Regents of the Univ. of California

(c)Copyright 1980, 1984, 1986 Novell, Inc.

Network Printer Configuration

Network Printer Configuration

     Configurable Parameters:             Current Settings

     ------------------------             ----------------

     1) Lp destination name:              [LPSYLIVE]

     2) Network System name:              [10.11.1.200]

     3) Printing Protocol/Interface:      [LPD]

     4) Remote Printer name:              [lpliv]

     5) lpd Banner page:                  [Enable]

     m) Model Script Selection:           [(N/A)]

Network Printer Configuration

     Configurable Parameters:             Current Settings

     ------------------------             ----------------

     0) Done. Make Configuration now!

     1) Lp destination name:              [LPSYLIVE]

     2) Network System name:              [10.11.1.200]

     3) Printing Protocol/Interface:      [LPD]

     4) Remote Printer name:              [lpliv]

     5) lpd Banner page:                  [Enable]

     m) Model Script Selection:           [ESCP]

     c) Configure options of the Model Script

     q) Quit

Select an item for change or select 0: 0

WARNING: This operation requires lp spooler be shut down.

The spooler will be running again after this operation is done.

If there are jobs currently being printed, those are reprinted in

their entirely after spooler is started again.

OK to continue? (y/n, default-n): y

lpadmin: corrupted member file

Error occurred during printer adding procedure!

Press the return-key to return to main menu...

we tried to restore the "lpadmin" file under /usr/sbin from a recent backup without success.

Any suggestion plz?

Regards

[Dennis Handly]

>lpadmin: corrupted member file

>/usr/sbin/lpadmin from a recent backup without success.

The problem wasn't in lpadmin but one of the printer config files.

[meekrob]

Could you please specify?

How to know which file among multiple files related to lp is the one concerned?

Thanks in advance

[Dennis Handly]

>Could you please specify?

Unfortunately the message doesn't say which.  :-(