how to disable dvd-rom drive?

[Torsten.]

I already asked in one of your other threads what you want to achieve ... you can set up your system that way that root only can mount the DVD. If this is not enough for you (for whatever reason), consider to disconnect the drive ...

[Dennis Handly]

>Torsten: you can set up your system that way that root only can mount the DVD.

This is the default.

[Torsten.]

I know.
That's why I asked for the reason why this drive should be "disabled".

[Dennis Handly]

>ME: This is the default.

>Torsten: I know.

Other than sudo or RBAC type solutions, do you know of any way the user can mount it?

[Torsten.]

I use sudo and a scripted mount/umount.

[Bob E Campbell]

Please speak to your auditors. If you have physical access to a computer system it is not secure. If physical access to the system is restricted then disabling the drives may may it more difficult to update the software and firmware of the systems. Those updates may include security fixes that keep the remote bad guys away.

Then again if you make them happy and they go away for a year, we understand...

[Bill Hassell]

Your auditors are thinking in terms of PCs on desks in the office. If your HP-UX servers are in a secure computer room, then *ALL* the hardware is as secure as the computer room. Uncontrolled physical access means absolutely no security at all. Disabling the DVD is silly when the bad guy can walk in and cycle the power to start a reboot and find a console connection to interrupt the boot process.

Now if this HP-UX box is indeed a workstation in an uncontrolled environment such as an office, then disabling the DVD prevents booting up a diagnostic CD. But why bother? The workstation is completely vulnerable with physical access.

[fizan]

as of now planned to delete the device file and in case if we want it.

ioscan -funC disk (hw path is shown)
insf -eH 0.2.2.2.2
in this i got a dowt whther if we run the ioscan it will show the hw path of dvd-drive?

then whether its persistent across the reboot.?

Thanks.

[Torsten.]

Does this make sense? IMHO not, since root only can mount the DVD and root can create the device files. In addition a reboot will recreate the device files anyway.

You still didn't explain why exactly you want to do this.

As said above, if somebody has root or physical access, "disabling" will be totally useless, if you really want, remove this unit.


Keep in mind that modern servers can have virtual media too ...

[fizan]

some of the oracle users have the root access but they dont recreate the device file. so only form our part its done tortsen,

then after rmsf -H 0.2.2.2.

wat will be the out put if we run ioscan -funC disk?

[Torsten.]

Keep in mind that root can do everything.

If you delete something, root can create it again.

Why on earth do you want to disable this drive???

If you are root, you can create, delete files, import, export them via network or whatever ... even without access to the DVD drive.





What is your concern regarding the DVD drive exactly???

[fizan]

in all our aix, linux boxes they disabled the usb drives and cd-drives, now they ask to disable the drives in hp-box also so this is my ground need to be done..

if i give rmsf -H 0.0.2.1
then if i run the ioscan -funC disk

/dev/rdsk/c0t0d0 will not be there
or
cd /dev/dsk
c0t0do will not be there?

[Torsten.]

If you reboot the server the device files will be there again.

Why disable?

If somebody has physical access he can do other bad things too ... if you can connect or insert anything, you need at least system access (as root) in order to do anything.

If you allow other persons to be root, the drive is not your concern!

The only secure way to disable a drive like this is to rip it out.


Just wondering how did you "disable" them on other operating systems?

[fizan]

tortsen,

if i give rmsf -H 0.0.2.1

where the special file will be deleted?

[Torsten.]

It will delete the dsk and rdsk file until next run of insf or next reboot or even next ioscan on 11.31.

[fizan]

so in ioscan nothing gets changed. by doing rmsf

changes only in /dev/dsk and /dev/rdsk.

[R.K. #]

Hi..

Earlier..
disk 9 1/10/0/1.12.0 sdisk CLAIMED DEVICE HP 36.4GMAN3367MC
/dev/dsk/c1t12d0 /dev/rdsk/c1t12d0

# rmsf -H 1/10/0/1.12.0
# ioscan -fnC disk

disk 9 1/10/0/1.12.0 sdisk CLAIMED DEVICE HP 36.4GMAN3367MC

So you will not see /dev/dsk/ and /dev/rdsk/, you will see only HW path in one line.

To make everything normal:
# insf -eC

[Hein van den Heuvel]

>> in all our aix, linux boxes they disabled the usb drives and cd-drives, now they ask to disable the drives in hp-box also so this is my ground need to be done..

Ok, so there's that Windoze thinking again.

First of all an assumption that physical access to the system is uncontrolled, which is hopefully NOT the case but you still have to confirm that.

Secondly, it sounds like this particular audit concern tries to target 'uncontrolled' files coming and going to the system, notably going. [ one of my customers has a similar rule ]. The TEAC DV-28E-C is a DVD-ROM. So that should be all you need to tell them if the concern is data being taken from the system using physical media.

Good luck!
Hein.