HACMP service dependencies 1

[Ukyo]

Hi,

as a security rule of thumb, a system shouldn't run services/sub servers/daemons that aren't used. I've been having trouble tracking down the service dependencies for HACMP. Does any1 know what can and can't be disabled for HACMP to work properly?

Thanks in advance!

Ukyo

 

[PSD]

Ukyo,

Really we should be reversing the question here, what are the services you want to comment out? HACMP only requires the key TCP/IP services i.e. things you cannot stop from running. Post up what you would like to stop and lets take it from there.

Cheers

Paul PSD
IBM Certified Specialist - AIX V4.3 Systems Support
IBM Certified Specialist - AIX V4 HACMP

 

[Ukyo]

Paul,

It's been a while... and this task has been on the backburner.
I hope to only leave godm, and login in /etc/inetd.conf and removing the rest.
We maybe considering to leave telnet and ftp until we have ssh up and running.
Am I right that HACMP uses godm? and it uses "login" for rsh for C-SPOC related things?

From /etc/inittab, we plan to remove:
- httpdlite
- dt_nogb
- imnss
- piode
- qdaemon
- uprintfd

In /etc/rc.tcpip, we plan to only keep snmpd because I think smux needs this and therefore, cluster smux may need this.

Will I break anything from what I plan to do?

Thanks,

Ukyo

 

[avadh]

Hello,
IMNSS is for man page search and documentation.
HTTPlite is HTTP server with lite version.

 

[PSD]

Ukyo,

That all looks fine - godm is required by HACMP when sync. the cluster. Also rshd will be used (rlogin) will not be used, this is of course dependant of the existance of an .rhosts file.

The inittab services you listed have no impact of HACMP so they are o.k.

When you say only leave snmpd in /etc/rc.tcpip, what about portmapper and inetd (for rsh and godm) they are both required for TCP/IP.

When you comment everything out I would take HA down and sync. topology and resources and perhaps ensure that a failover is successful.

Let me know if I can be of further help.
Cheers

PSD
IBM Certified Specialist - AIX V4.3 Systems Support
IBM Certified Specialist - AIX V4 HACMP

 

[Ukyo]

Paul,

/etc/rc.tcpip portmapper and inetd will be left intact as suggested.

I also suggest the following link for people who want to know a little about the services in AIX

http://ist.uwaterloo.ca/security/howto/2001-01-15/

Thanks for all your assistance,

Ukyo