can not update /etc/services

[aimai]

I have a problem with /etc/services file.
Even though I add new configuration to /etc/services by ROOT user, it remains unchanged after re-booting.
Needless to say, I typed ":wq" to end vi editor.
However, once I do re-boot server, those added lines disappear!! Why?

( Sorry for my terrible English. I am Japanese.)

[Michael Tully]

You shouldn't need to reboot your system for updating the /etc/services file. When you save the file you should type in :wq!

The default permissions of /etc/services are
-r--r--r-- 1 bin bin 13267 Jun 25 15:58 /etc/services

[Animesh Chakraborty]

hi,
you have to type :wq! as it is read only file.
Can you tell us what exactly u are adding in /etc/services file?

[aimai]

Thank you for your reply!
Following is the current file status.
As you see, it is writable somehow..

[-rw-r--r-- 1 ftp2smtp ftp2smtp 9648 Jul 12 13:19 services]

Even though I changed the mode to Read Only, the file mode was retrieved as above after re-boot..So strange!

ups 12000/upd
ups 12000/tcp
xups 12010/upd

I just want to add above three lines.

After updating, I opened the file and conrirmed surly the file was updated.
Therefore I assumed ":wq" did work...

Will try ":wq!" for next trial anyway.

* Is it really no need to re-boot for updating
/etc/services?

[Michael Tully]

Hi,

Your English is fine!!!

Like many updates to your system, updating /etc/services or /etc/inetd.conf DOES NOT require a reboot after making changes. Some files may need a refresh to the command but definitely not a reboot.

HTH
Michael

[Michael Tully]

Hi,

Your English is fine!!!

Like many updates to your system, updating /etc/services or /etc/inetd.conf DOES NOT require a reboot after making changes. Some files may need a refresh to the command but definitely not a reboot.

HTH
Michael

[U.SivaKumar_2]

Hi,
Changes in /etc/services and
/etc/inetd.conf should be followed by a restart of inetd
daemon to re-read those files
for new configuration to come in to effect. So you have to
do this after updating those files.
#inetd -c
you need not reboot the system.
regards,
U.SivaKumar

[Hartmut Lang]

Why does your /etc/services file belong to user "ftp2smtp" and group "ftp2smtp"?

I think this is not a good idea it should be owned by user "bin" and group "bin".

If your /etc/services file gets changed on boot-time, maybe one of your rc-scripts makes this changes. You could do:
cd /sbin/init.d
grep services *

On my machine (HPUX11i) it seams that the nfs.core scripts does really update /etc/services (if needed) on boot time. Check this and other rc-scripts on your machine.

Hartmut

[aimai]

Thank you Michael, animesh chakraborty and
Sivakumar.

I understand I no need to reboot!
Thanks to this advaice, I could test with ease.

I have tried to add three lines to
/etc/services and ":wq!", also I have changed
the file permission from -rw-r--r-- to
-r--r--r--, then submit "inetd -c" from root user.

After that, I realized that
/etc/services is being reinstated automatically,
regardless re-boot or not!

I checked the file permission in every about 5 seconds. As you can see below, "-rw-r--r--" appears!!
This means the contents also relapsed.


-r--r--r-- 1 ftp2smtp ftp2smtp 9704 Jul 12 16:15 services
# ll services
-r--r--r-- 1 ftp2smtp ftp2smtp 9704 Jul 12 16:15 services
# ll services
-r--r--r-- 1 ftp2smtp ftp2smtp 9704 Jul 12 16:15 services
# ll services
-r--r--r-- 1 ftp2smtp ftp2smtp 9704 Jul 12 16:15 services
# ll services
-rw-r--r-- 1 ftp2smtp ftp2smtp 9648 Jul 12 16:16 services



Wondering this is my server specific problem?!

[Steven Sim Kok Leong]

Hi,

Check your cron jobs for any script that is monitoring /etc/services and replacing it:

# grep '/etc/services' /var/spool/cron/crontabs/*

If nothing comes out of that, then run lsof on /etc/services:

# while sleep 1;do lsof /etc/services;done

This will monitor what process actually accesses /etc/services during the change.

Hope this helps. Regards.

Steven Sim Kok Leong

[Steven Sim Kok Leong]

Hi,

You can download lsof from:

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.61/

After you installed lsof, the sequence of steps you can perform to monitor is:

# vi /etc/services
:wq
# while :;do lsof /etc/services;done

If a process is accessing /etc/services to change it, the process should appear promptly during the lsof.

Btw, you don't need to run inetd -c when you only modify /etc/services. It is only a lookup table.

You can verify this by doing this:

# echo "test 21/tcp" >> /etc/services
# telnet an_ftp_server test

You should see the FTP banner promptly, verifying that "test" is translated to TCP service port 21.

Hope this helps. Regards.

Steven Sim Kok Leong

[Hartmut Lang]

I think your services-file is updated by a process which is owend by user "ftp2smtp".

ps -ef | grep ftp2smtp will show you all the according processes. One of these will do this "magic" thing.

Hartmut

[aimai]

To all,
Thank you for your help.

Actually, I am wondering why the user/group is not "bin".. Will ask what you pointed to our vendor who installed the OS.

Have run the advised command;
[# cd init.d
# grep services *]
then suspicious results came out!

nfs.core:grep "2049/tcp" /etc/services > /dev/null 2>&1
nfs.core:cp -p /etc/services /etc/services.update
nfs.core:/etc/services >/etc/services.update
nfs.core:mv /etc/services.update /etc/services

Also I have downloaded "lsof".
Will try to run the sequence step.

Thanks!

Imai

[Hartmut Lang]

If you do a
chown bin:bin /etc/services
and
chmod -w /etc/services

your "magic" process might not be able to rewrite your /etc/services-file.

Hartmut

[aimai]

Thanks for your advices.

Have submitted "lsof" and changing owner ID/Gourp ID.

Results are as follows;
1/ Unfortunately, our server is 64bit kernel.
Therefore, downloaded "lsof" command did not run...

2/ Submitted "chown bin:bin" and "chmod -w",
but /etc/services was returned somehow...!

I am asking our Vendor to give us solutions,
but nothing they reply so far..

As I am not a professional user of UNIX,
I am very happy to have a lot of very useful information
from all of you here.

Now, I'm trying to make a shell to run "ps -ef | grep ftp2smtp" for two minutes.



Thanks.

Imai

[Steven Sim Kok Leong]

Hi,

You should be able to download the source for HP-UX 11.00 and compile the source on HP-UX 11.00 64-bit. Once the binary is compiled, it should be able to run properly in your 64-bit HP-UX.

Hope this helps. Regards.

Steven Sim Kok Leong

[harry d brown jr]

I bet you have an Intrusion Alert process that is detecting that /etc/services has changed and is changing it back. Ask your vendor about it.

for an 11i system try the attachment:


live free or die
harry

[aimai]

Steven,
Thanks. I could find and could download "64".
However, I was said "Execute permission denied". Pls see below;

# lsof
sh: lsof: Execute permission denied.

# while sleep 1; do lsof /etc/services;done
sh: lsof: Execute permission denied.
sh: lsof: Execute permission denied.
sh: lsof: Execute permission denied.
**--File Permission-----**
-rwxr-xr-x 1 bin sys 252940 Jul 16 11:01 lsof

Is there any other step to activate it?

Harry,

Thanks for your reply. Somehow I can not retrieve the attachment file.(Error occured)
Is it a script or something?
Could you please kindly paste the contents
here, if possible.

Thnaks,
Imai

[U.SivaKumar_2]

Hi,

try this
./lsof /etc/services

regards,
U.SivaKumar

[Steven Sim Kok Leong]

Hi,

Download the source gzip'ed tarball from the following link:

http://hpux.cs.utah.edu/ftp/hpux/Sysadmin/lsof-4.61/lsof-4.61-ss-11.00.tar.gz

Then compile it:

# ./configure
# make
# make install

Hope this helps. Regards.

Steven Sim Kok Leong