Trusted System, inetd, a bad app and persistent children

[Mark Ferraretto]

Hello all,

I have a rather unusual problem (was 'I've never seen this before' in that top admin response post?) involving the Trusted System, inetd and MQSeries.

We have a standard security setup where we basically do this:
- enable the trusted system
- enable default auditing
- deny most inetd services using SAM (ftp, tftp, rexec etc. Basically we just leave telnet running plus any app services)
- also we comment out the lines in /etc/inetd.conf for the services we don't run - a double whammy.

MQSeries runs a few services in /etc/inetd.conf. We leave these enabled and allowed (obviously). Now, the problem is that when this configuration is set up, we can't connect to MQSeries. However, if we don't run the trusted system (ie: /usr/lbin/tsconvert -r) then MQSeries runs just fine! As soon as I convert to a trusted system and re-start inetd the problem arises.

This brings me to the children issue. When I run inetd under the trusted system I get about 5 - 10 children that spawn off. If I kill the parent inetd the children don't die. I have to kill them too. I can kill the parent and start a new one and the children still hang around. But when I'm not running a TS there are no children inetd processes.

A couple of other things. I've run inetd -l and it shows a successful connection into the MQSeries service even though I can't connect. This leads me to believe that inetd may be processing the incoming request correctly but that MQ dies after starting up

Second is that if I configure inetd.conf so that MQ runs as root instead of the MQ user (mqm) then I get a connection OK. This would suggest a permissions problem normally but the fact that this problem only occurs when running a TS seems to contradict this. Nonetheless I've checked that all the permissions and ownerships are OK and also we're installed on VxFS filesystems so ACL's aren't a problem.

Any suggestions would be appreciated.

Thanks

Mark

[Dan Hetzel · Accepted solution]

Hi Mark,

If you're running 11.0, Cumulative inted patch PHNE_21835 is supposed to solve the following (from patch description):
"Child inetd process may hang for non-root service on trusted 11.0 system."

Best regards,

Dan

PS: here's the link:
ftp://ftp.itrc.hp.com/hp-ux_patches/s700_800/11.X/PHNE_21835

[Mark Ferraretto]

Thanks, Dan.

I applied the patch and now MQSeries runs just fine under a Trusted System. All those pesky inetd children have disappeared too.

I forgot to mention that, yes, I am running 11.00 on a L2000.

Mark