inetd 'warning' : fs.auto: Hangup

[dmarsee]

dmesg is collecting the following warning thousands of times/hour. I haven't noticed any other negative symptom (yet). So far my search for a clue in man and other sources (like Tek-Tips) have yielded nothing.

inetd[200]: [ID 858011 daemon.warning] /usr/openwin/lib/fs.auto: Hangup

Anyone have a clue??

Thanks, in advance

Don

 

[cfsalmeida]

Do you have auditing enable ? if yes, the font server doesn't get started by inetd configured with nobody, replacing nobody with root causes it to run edit
"/etc/inetd.conf" and make fs.auto run as root instead of nobody then:
# chmod +s /usr/openwin/bin/xfs (what fs.auto is a link to)
# chown nobody:nobody /usr/openwin/bin/xfs
now refresh inetd
Security should be the same, you can check with:
# fslsfonts -server [server]:7100

you can verify with "ps -ef |grep fs", that fs will be running as nobody...

Regards,

Carlos Almeida,

 

[dmarsee]

Thanks for the reply...

auditd is running...

fs.auto (xfs) is NOT running... but it is NOT commented out in inetd.conf (!?) If it were running it would be as nobody :

fs stream tcp wait nobody /usr/openwin/lib/fs.auto fs

Sooo.. the font server is not running, eh??

fslsfonts -server [server]:7100
fslsfonts: unable to open X font server "[server]:7100"

Is each of those messages an attempt to run fs.auto?? or ...

 

[cfsalmeida]

yes ... but what I mean is you have to change from nobody to root to solve the problem or change inetd:
from:
fs stream tcp wait nobody /usr/openwin/lib/fs.auto fs
to:
fs stream tcp wait root /usr/openwin/lib/fs.auto fs
then use this to mantain security:
# chmod +s /usr/openwin/bin/xfs
# chown nobody:nobody /usr/openwin/bin/xfs
then refresh inetd by send signal hangup to inetd pid, eg:
# ps -ef | grep inetd
# kill -HUP <inetd-pid> (change <inetd-pid> with inetd pid obtain from ps -ef)
if you have service active in inetd as you said then the font server should be running:
# /usr/openwin/bin/fslsfonts -server [server]:7100
in the previous example you need to change [server] with your machine name or IP.

Hope it helps,

Regards,

Carlos Almeida,