PWGR - Turning off.

[joe_91]

All:

We are getting Flagged (For security reg. permissions)for /var/spool/sockets/pwgr directory on most of the servers.My proposal was to turn OFF this daemon and remove the pwgr directory so that i will not get flagged.
is it a good approach? will it have any impact?

Thanks

Joe

[Jeff Schussele]

Hi Joe,

If you're using NIS or NIS+ then there will be no effect.
If you're not using those then you'll suffer some performance hit - especially if you have lots of logins or any apps are using lots of getpwuid() or getgrname() calls because the pwgrd is a caching routine for these calls.
I would suggest you test this prior to implementation because the impact could range from negligible to severe.

My 2 cents,
Jeff

[Bill Hassell]

Not a problem. Edit /etc/rc.config.d/pwgr and set PWGR=0. pwgrd is a password and group caching daemon to speed up searches when the passwd file is thousands of entries. With a small password and group file it is not necessary. pwgrd listens on a Unix domain socket for client requests, and your security folks won't like having a socket that accepts codes to be processed as root, so it's a good idea to disable it.

[Thierry Poels_1]

hi,

if you have a relatively small passwd file you can stop the pwgrd daemon.
And if it is not running its cache cannot get corrupted (rarely happen but anyway) ;-)

regards,
Thierry.

[joe_91]

Bill/Jeff:

Thanks.

I think i am going to Disable it 'coz we run NIS and on other machines we just have very few id's who login (Oracle Boxes)
Ok here are the steps for disabling PWGR.

/sbin/init.d/pwgr stop
Edit the /etc/rc.config.d/pwgr and set it to 0

Next remove the directory /var/spool/sockets/pwgr directory
(because even if i disable it the directory will still be there) So is it ok to rm -r that direcotory?

Are these steps correct? Pl. Confirm

Thanks

Joe.

[A. Clay Stephenson]

It's not a problem to disable it. UNIX boxes ran without passwd and group caching literally for decades before this deamon came along. I doubt you will be able to detect any performance impacts.

[Jeff Schussele]

Yes - those steps sound appropriate.
Be advised that if you do any swverify options that would be looking for the pwgrd fileset/files it would flag an error on the missing items - not a problem but you need to be aware of the possibility.

Rgds,
Jeff

[joe_91]

Jeff & Team:

Perfect to remove the directory right. Now to get rid of that is there any fileset that we need to swremove?

Thanks

Joe

[Robert-Jan Goossens · Accepted solution]

Hi Joe,

No need to remove a fileset, you can remove the directory /var/spool/sockets/pwgr after you disabled the pwgr daemon.

Regards,
Robert-Jan

[Steven E. Protter]

If you want to remove the software.

swremove -i

Find it,
select it,
Action Remove.

It will be gone.

SEP