r-services

[Raghuram Ollakal_1]

I have 4 HP 9000 servers running HPUX 10.20 and HPUX 11.0. From our network control center I got an e-mail saying that the use of " r-services" on UNIX devices are discontinued and replaced with SSH. but one of my HP server is still running " r-services" how do I check this, if it running hwo can I turn this off.

[Sanjay_6]

Hi Raghu,

Try this link,

http://us-support3.external.hp.com/cki/bin/doc.pl/sid=fe26d522168dc3020a/screen=ckiDisplayDocument?docId=200000058036742

You can try this link from hp docs site too, Use inetd.sec to enforce security

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90685/B2355-90685_top.html&con=/hpux/onlinedocs/B2355-90685/00/00/10-con.html&toc=/hpux/onlinedocs/B2355-90685/00/00/10-toc.html&searchterms=inetd.sec&queryid=20020108-104518

Hope this helps.

Regds

[Uday_S_Ankolekar]

Hi,

With var/adm/inted.sec file you can actually control your all r-services.

-USA..

[Bill Hassell]

The r-services (such as rcp, rlogin, remsh) are enabled in /etc/inetd.con. The optional security file /var/adm/inetd.sec can be used to narrow down which IP addresses can use them, but to completely disable the -r-daemons, comment out the lines in inetd.conf:

login stream tcp nowait root /usr/lbin/rlogind rlogind
shell stream tcp nowait root /usr/lbin/remshd remshd
exec stream tcp nowait root /usr/lbin/rexecd rexecd

The tell inetd to re-read it's config file with inetd -c and you should find the r-services disabled.

[Craig Rants]

Raghuram,
Besides the information already provided, you will want to chech for .rhost files on you box.

find / -type -f -name .rhosts -exec ll {} \;

You will want to get rid of these files as well. What they are probably doing is blocking tcp ports associated with that traffic i.e. tcp/512, so you even if you use the inetd.sec to control access, you still can't use these services outside your LAN (this assumption is based on my prior government experience).

This isn't the worst thing to happen, ssh has all the capabilites or the r commands.

GL,
C

[Darrell Allen]

Hi,

I assume, since you only have 1 server still running the "r" services, this is not a ServiceGuard system. If is is you need to be sure you are using /etc/cmcluster/cmclnodelist before disabling the "r" services.

Darrell