ident service and Service Guard

[PamelaJThrasher]

I am running Service Guard version A.11.13 on a pair of HP 11.11 servers. We are trying to harden our servers. Do I need to leave ident enabled in inetd.conf?

Pam

[Sundar_7]

A.11.13 ? that is too OLD. I am afraid it may not even be currently supported by HP.

I know from A.11.14 onwards identd is used by hacl services to verify the nodes trying to communicate.

[Jeff_Traigle · Accepted solution]

You can disable identd on the SG versions that use it by adding the -i option to the following entries in /etc/inetd.conf:

hacl-probe stream tcp nowait root /opt/cmom/lbin/cmomd /opt/cmom/lbin/cmomd -i -f /var/opt/cmom/cmomd.log
hacl-cfg stream tcp nowait root /usr/lbin/cmclconfd cmclconfd -c -i

You'll see continuing messages in syslog regarding this "insecure" configuration, however.

[melvyn burnard]

SG A.11.13 is out of support for some time now, see:
http://docs.hp.com/en/5971/SG-SGeRAC-EMS-Support.pdf

Also, you MUST have at least PHSS_29120 to use identd functionality.
see also:
http://docs.hp.com/en/5874/securingserviceguard_nov2005.pdf

[PamelaJThrasher]

Thanks for all your help.