Disabling rlogin will affect service guard?

[Lashin]

hi,
I have 2 node cluster running ServiceGuard A.11.16.00 on hpux11.23.

I need to disable rlogin on both nodes for fixing security vulnerability suggested by auditors.

I can see .rhost file present on both nodes that will accept rlogin for root user from any nodes.
# cat .rhosts
+
#

there is no /etc/cmcluster/cmnodelist on both nodes

will it make any impact on service guard if i disable rlogin ?

[Kannandgl_1]

Dear ,


The same case in our security team requested disable rlogin and remote shell exe.. etc ..last week i did its not affecting. before make changes plase take bakup of /etc/cmcluster/package file ..

Note : After i disabled the /etc/init.d services for rlogin.


Regards

[Duncan Edmonstone]

Just make sure that the DNS names of all the interfaces on both systems are listed in cmclnodelist

So for example if you have 2 hosts called nodeA and nodeB, and they have additional interfaces called nodeA-hb, nodeB-hb (hearbeat LAN) , and interfaces called nodeA-bu and nodeB-bu (backup LAN), then you would want the following in cmclnodelist :

nodeA root
nodeA-hb root
nodeA-bu root
nodeB root
nodeB-hb root
nodeB-bu root



HTH

Duncan

[Lashin]

Hi Duncan,

I dont have /etc/cmcluster/cmnodelist file on both nodes.

[Duncan Edmonstone]

Just create it - it's only a text file.

HTH

Duncan

[Lashin]

Hi Duncan,

I understand that /etc/cmcluster/cmnodelist or .rhost file is used only when we apply a clusture configuration. A running cluster or packages do not read /etc/cmcluster/cmnodelist or .rhost file to login to other cluster nodes...Please correct me if i am wrong..

[Duncan Edmonstone]

Yes IIRC that's the case, but I wouldn't want to be fiddling around creating it when I actually have changes to make. Better to put it in place now.

HTH

Duncan

[Emil Velez]

some of the serviceguard commands will not work without a cmclnodelist

create it. It should not be a problem.

[Bill Hassell]

>> # cat .rhosts
>> +

This is the worst possible content for root's .rhosts file on any system. It essentially says:

Trash my system, there is no security here!

If you need rlogin/remsh/rcp between two computers, put *only* those computer names and user login names in the .rhosts file. Putting + in there is the same as removing the password for root.