how to disable dvd-rom drive?

[fizan]

# ioscan -funC disk
Class I H/W Path Driver S/W State H/W Type Description
============================================================================
disk 0 0/0/2/0.0.0.0 sdisk CLAIMED DEVICE TEAC DV-28E-C
/dev/dsk/c0t0d0 /dev/rdsk/c0t0d0

[Michal Kapalka (mikap)]

hi,

disable for some users, or permanently disable ??

mikap

[fizan]

due to audit purpose, now it should be disabled and in future if we need then again to enable it?

Thanks

[Michal Kapalka (mikap)]

hmm you could change the permition to 000.

mikap

[fizan]

but that is not the right way? to disable.. any alternate way.

[fizan]

cd /dev/dsk
chmod 000 c0t0d0
right.. they are not accepting?

how to disable it.?


Thanks

[Michal Kapalka (mikap)]

hi,

if you will delete the special file from the device, after reboot it will be renewed.

I think, the audit is also about physical security, so nobody can't mount a cdrom if there is not a CD/DVD medium.

The second option is to disconnect the dvd drive on HW level.

mikap

[Michal Kapalka (mikap)]

hi,

ok you could change the permition only for the root user.

mikap

[fizan]

no the server will not be rebooted if we can do we restart the service, mikap

in h/w level, we should unplug the id scsi cable connecting to dvd drive right?

[Michal Kapalka (mikap)]

hi,

so if you don't reboot the server

make rmsf -H ( HW_PATH of dvd/cd )

mikap

PS : yes yous unplug the cable from drive.

[fizan]

if i change using chmod 000 c0t0d0 all the users will be restricted to mount the cd.?

[Michal Kapalka (mikap)]

if the users dont have rights to use the devioce nobody can use it and mount.

mikap

[fizan]

so, now your suggestion is to

rm -rf /dev/rdsk/c0t0d0

2,

if we want to enable it ..

rmsf -H 0/0/2/0.0.0.0

correct?

[Michal Kapalka (mikap) · Accepted solution]

hi,

no rmsf = delete the spacial file on the HW-path

if you like too access it you need to make insf -eH HW_PATH

mikap

[Michal Kapalka (mikap)]

ho

never use a command rm to removing of special file.

mikap

[fizan]

thanks mikap, for ur timely help.

[fizan]

so in hp-ux there is no option to disable the cd-drive and enable it when needed right?

[Pete Randall]

What do you mean, the server won't be rebooted? How can you guarantee that? Have you considered power failures? Patching? Hardware failures? Any number of realities can cause a server to have to be rebooted and, every time you reboot, insf is run and your device is going to reappear. That is not going to make your auditors happy. The only sure way to disable it, is to unplug the SCSI cable.


Pete

[fizan]

deleted: rmsf 0/0/2/0.0.0.0

enable it:
run ioscan -H (to show hard ware path)
identify the hw path.

insf -eH 0/0/2/0.0.0.0

these are the steps to be followed ..


Thanks,

[Michal Kapalka (mikap)]

hi,

if you are making rmsf you need to make -H switch to delete the HW_path.

mikap

[SoorajCleris]

Hi Fizan,

I can see so many threads ...


» how to disable dvd drive?
» how to disable dvd-rom drive?
» how to check status of cd-drive ?

http://forums13.itrc.hp.com/service/forums/questionanswer.do?threadId=1360607
http://forums13.itrc.hp.com/service/forums/questionanswer.do?threadId=1360992
http://forums13.itrc.hp.com/service/forums/questionanswer.do?threadId=1360981

May I please know which one I should reply???
Did you get the answer ?

Regards,
Sooraj

[fizan]

boss ,

ultimate goal is to disable the drive.

[Pete Randall]

Try a hammer.


Pete

[Pete Randall]

Why do the auditors want to do this? Are they trying to prevent ordinary users from using the cd/dvd drive? Ordinary users are not allowed to mount the drive anyway, so, to them, it is effectively disabled.

We need a clearer answer as to what is trying to be accomplished.


Pete

[Hein van den Heuvel]

I'd say 'question to auditor'.
Let them explain why this is deemed a concern and explain how you addressed that concern, not the cd drive.

Surely this HPUX system is not 'out in the open' where an uncontrolled individual can slip in a DVD and opportunistically wait for a reboot? Show them the physical access methods in place.

Possibly focus on not being able to (automatically) boot from the DVD drive not that I would not know how without knowing the system. More details on the system will be more important than detail on the DVD drive itself.

Regards,
Hein.