Usenet 1993 July/InfoMagic USENET CD-ROM July 1993.ISO/answers/sgi/faq/admin

Internet Message Format | 1993-06-02 | 17.9 KB

Path: senator-bedfellow.mit.edu!enterpoop.mit.edu!gatech!howland.reston.ans.net!spool.mu.edu!olivea!sgigate!odin!fido.asd.sgi.com!holodeck.csd.sgi.com!aschaffe
From: [e-mail] (Allan Schaffer)
Newsgroups: comp.sys.sgi.misc,comp.sys.sgi.admin,comp.sys.sgi.apps,comp.sys.sgi.bugs,comp.sys.sgi.graphics,comp.sys.sgi.hardware,comp.answers,news.answers
Subject: SGI admin Frequently Asked Questions (FAQ)
Supersedes: <[e-mail]>
Followup-To: comp.sys.sgi.misc
Date: 2 Jun 1993 06:37:57 GMT
Organization: Silicon Graphics, Inc., Mountain View, CA
Lines: 451
Approved: [e-mail]
Expires: 1 Jul 1993 06:37:47 GMT
Message-ID: <[e-mail]>
References: <[e-mail]>
Reply-To: [e-mail]
NNTP-Posting-Host: holodeck.csd.sgi.com
Originator: [e-mail]
Xref: senator-bedfellow.mit.edu comp.sys.sgi.misc:2634 comp.sys.sgi.admin:1753 comp.sys.sgi.apps:772 comp.sys.sgi.bugs:929 comp.sys.sgi.graphics:1182 comp.sys.sgi.hardware:1429 comp.answers:859 news.answers:8989


Archive-name: sgi/faq/admin

           SGI admin Frequently Asked Questions (FAQ)


This information is freely distributable and wide circulation is encouraged.
The contents are accurate as far as we know, but the usual disclaimers apply.
This FAQ contains errors! Finding them is an exercise for alert readers.

Please send additions and changes to [e-mail].

This FAQ is one of the SGI FAQ series, which consists of:

     SGI Admin FAQ - IRIX System Administration
     SGI Apps FAQ - Applications & Compilers
     SGI Graphics FAQ - Graphics & Windowing
     SGI Hardware FAQ - Hardware issues
     SGI Misc FAQ - Introduction & Miscellaneous Information

Each FAQ is posted to each comp.sys.sgi.* group as well as the news.answers
and comp.answers newsgroups (whose purpose is to store FAQs) every two weeks.
If you can't find one of the FAQs with your news program, you can get it by
anonymous FTP from one of these sites:

 rtfm.mit.edu:pub/usenet/news.answers/sgi/faq/admin
 rtfm.mit.edu:pub/usenet/comp.sys.sgi.misc/SGI_admin_Frequently_Asked_Questions
 archone.tamu.edu:ftp/pub/sgi/faq/admin
 rtfm.mit.edu:pub/usenet/comp.answers/sgi/faq/admin

Note that rtfm.mit.edu is home to many other FAQs and informational documents,
and is a good place to look if you can't find an answer here.

Topics covered in this FAQ:
--------------------------
  -1- How can I quickly find the question I want in this FAQ?
  -2- Is it possible to use a system with graphics to run the
      Visual System Manager ('vadmin') on a system without graphics?
  -3- Is it possible to boot from a CD-ROM?
  -4- Is it possible to remotely install IRIX over a network?
  -5- How can I track failed login attempts on my system?
  -6- I've configured 'tftp' in /usr/etc/inetd.conf -- why
      isn't it working?
  -7- Is 'pcnfsd' available for the SGI?
  -8- How do I set the number of processes allowed on my machine?
  -9- I think I've found a security hole in IRIX; who do I
      notify at SGI?
  -10- I want to install a termcap for 'iris-ansi-net' on my
       non-SGI system, but I can't find a termcap file on the
       SGI.  Where can I get one?
  -11- My SGI crashed and generated a file, /usr/adm/crash/vmcore.1 .
       How can I examine this file to see what crashed my system?
  -12- Why can't I export an NFS-mounted filesystem?
  -13- Why is my network license daemon ('netlsd') exiting?
  -14- How do I log anonymous ftp sessions?
  -15- How can I determine my SGI's unique ethernet hardware address?
  -16- Security problem with pre-IRIX4.0.5 'lp'
  -17- Why isn't /usr/adm/SYSLOG isn't being updated?
  -18- Credits

----------------------------------------------------------------------

Subject:   -1- How can I quickly find the question I want in this FAQ?
Date: 27 May 93 00:00:01 EST

- This FAQ follows the RFC1153 recommendations for message digests and thus
  can be viewed easily with newsreaders that understand message digests.
- Each question has a Subject: line, so you can easily step through the answers
  with rn's ^G command.
- Each question is marked with a "dash number dash" so that you can find any
  answer with a simple search pattern.
- Questions marked with a '+' are new this posting; those marked with a '!'
  have significant new content since the last edition.

------------------------------


Subject:   -2- Is it possible to use a system with graphics to run the
               Visual System Manager ('vadmin') on a system without graphics?
Date: 20 May 93 00:00:01 CST

Yes.  Make sure the DISPLAY environment variable is set correctly, and
the shared libraries in eoe2.sw.X11 and eoe1.sw.unix must be installed
on the graphic-less system (which is the default installation), along
with all the eoe2.sw.vadmin stuff.  It is also a good idea to install
eoe2.sw.4Dwm, eoe2.sw.WinSpt, and eoe2.sw.Xapps as well.

------------------------------

Subject:   -3- Is it possible to boot from a CD-ROM?
Date: 20 May 93 00:00:01 CST

Yes, for systems with new PROMs, such as Indigo and Crimson, it can be done.
For older systems it can be done with the SGI CD-ROM drive, but it can get
frustrating in some cases.  For some older systems, it may be necessary to
use either a local tape drive, or boot them over the network.

------------------------------

Subject:   -4- Is it possible to remotely install IRIX over a network?
Date: 20 May 93 00:00:01 CST

Yes.  There are several different ways to do this:
   - from a remote machine with a CD-ROM
   - from a remote machine with a tape drive
   - from a remote machine with an IRIX distribution directory

All of these scenarios (and several others) are described in detail in the
"IRIS Software Installation Guide".  Examples are provided.

------------------------------

Subject:   -5- How can I track failed login attempts on my system?
Date: 20 May 93 00:00:01 CST

Put syslog=all in /etc/config/login.options, as described in 'man login'.
In IRIX 5.* this is set in /etc/default/login.

Add logging arguments to lines in /usr/etc/inetd.conf, as directed
by the man pages for the ftpd, rshd, tftpd daemons.  Fingerd has an
undocumented option, "-l", to enable logging.  For rshd, it is "-L".

As of IRIX 5.0.1, inetd.conf is in /etc.

------------------------------

Subject:   -6- I've configured 'tftp' in /usr/etc/inetd.conf -- why
               isn't it working?
Date: 20 May 93 00:00:01 CST

The command in /usr/etc/inetd.conf that starts up tftpd is:
tftp    dgram   udp     wait    guest   /usr/etc/tftpd  tftpd -s /usr/local/boot

Or something similar.  Changes made to this file will NOT take effect until
you do (as root) 'killall -HUP inetd', or reboot.

------------------------------

Subject:   -7- Is 'pcnfsd' available for the SGI?
Date: 20 May 93 00:00:01 CST

Yes.  A binary and man page are available via anonymous ftp from
ftp.sgi.com, in ~ftp/support/pcnfsd.sysV.  It is unsupported, as
the included README disclaimer will tell you.

------------------------------

Subject:   -8- How do I set the number of processes allowed on my machine?
Date: 20 May 93 00:00:01 CST

Under IRIX 4.*, change NPROC in /usr/sysgen/master.d/kernel, run
'/etc/autoconfig -f', and reboot.  If NPROC gets too big, you may
get a message upon booting that you've run out of spinlocks.  In
that case you'll then need to increase NSPLOCK.

If you're changing NPROC, you may wish to adjust MAXUP, since it
controls the maximum number of processes per user.

------------------------------

Subject:   -9- I think I've found a security hole in IRIX; who do I
               notify at SGI?
Date: 20 May 93 00:00:01 CST

In general, if you find a security problem (or think you have), you can send
it to [e-mail] .

You can also notify CERT ([e-mail]), and they will contact the appropriate
people from their contact list.

------------------------------

Subject:   -10- I want to install a termcap for 'iris-ansi-net' on my
                non-SGI system, but I can't find a termcap file on the
                SGI.  Where can I get one?
Date: 20 May 93 00:00:01 CST

SGIs use the system 5 style terminfo stuff.  What you want can be done though.
See 'man infocmp', and the documentation about -r.  This should do the job:
'infocmp -Cr iris-ansi'.

If you don't have infocmp, you have to install eoe2.sw.terminf, which is not
installed by default.

------------------------------

Subject:   -11- My SGI crashed and generated a file, /usr/adm/crash/vmcore.1 .
                How can I examine this file to see what crashed my system?
Date: 20 May 93 00:00:01 CST

dbx -k /usr/adm/crash/{unix,vmcore}.#
t
&putbuf/1000s

Is a reasonable starting sequence.  The Technical Assistance Center (TAC)
has some scripts that they have customers run to provide more info in some
cases.

------------------------------

Subject:   -12- Why can't I export an NFS-mounted filesystem?
Date: 20 May 93 00:00:01 CST

This is known as multi-hop NFS and is not allowed/supported in (Sun's) NFS.
SGI decided in IRIX 4.0.X it was better to prevent attempts to export
NFS-mounted filesystems than to catch the error on client access.

------------------------------

Subject:   -13- Why is my network license daemon ('netlsd') exiting?
Date: 20 May 93 00:00:01 CST

For netlsd to run, you need to have 'llbd' and 'glbd' installed and
running.  A complete debugging procedure is in the netls release notes,
which can be read with 'relnotes netls_eoe 5'.

------------------------------

Subject:   -14- How do I log anonymous ftp sessions?
Date: 20 May 93 00:00:01 CST

The IRIX 4.0.X 'ftpd' will make additional entries to the syslog with
the '-l' option.  'ftpd -ll' will keep an accounting of how many times
a file is requested and by whom, and 'ftpd -lll' will log the number
of bytes transferred as well.  'man ftpd' for more details.

------------------------------

Subject:   -15- How can I determine my SGI's unique ethernet hardware address?
Date: 20 May 93 00:00:01 CST

There are several ways to do this.  Many thanks to [e-mail],
for providing this robust answer and discussion:

Determining Your System's Address(es): Ethernet versus Internet Protocol

The physical Ethernet address of your system is the unique number assigned
to the Ethernet hardware on your system and is not to be confused with the
IP address which can be set. This unique number is assigned to the
manufacturer of your Ethernet hardware by the IEEE, (previously assigned by
Xerox, one of the original developers of Ethernet). Every system on an
Ethernet network must have a unique Ethernet address for the network to
operate properly.

You may need to determine your system's Ethernet address if your network
manager requires it before connecting your system to a network.

There are several ways to obtain the Ethernet address, depending on whether
IRIX is running and what operating system version is loaded.

Method 2 will only provide the Ethernet address of the Primary
interface. If you have multiple Ethernet interfaces (boards) in a system,
use Method 1 or Method 3 to determine the address(es) of any other
interface(s).


METHOD 1:  netstat

If you are running version 4.0.X of IRIX, you can use the netstat command to
obtain your Ethernet address. For example:

% /usr/etc/netstat -ia

Name  Mtu    Network   Address            Ipkts   Ierrs   Opkts  Oerrs  Coll
ec0   1500   siligrph  luey7              7765678 21648  384477     0  30338
                        192.48.200.251
                        192.0.0.1
                        08:00:69:06:17:c2
lo0   32880  loopback localhost           41438       0   41438     0      0
                        192.0.0.1

In the preceding example the Ethernet address of the system luey7 is
08:00:69:06:17:c2 as seen on the fourth address line for the primary
Ethernet interface ec0.

METHOD 2:  eaddr

If IRIX is not running, and the system is an Indigo (4DRPC), Indigo2,
Personal IRIS (4D20, 4D25, 4D30, 4D35), Onyx, or Challenge you may obtain
the Ethernet address by typing eaddr at the prom monitor prompt. Instead
of booting the system, press the escape key to go to the System Maintenance
menu. Select 5 for the Command Monitor mode. At the >> prompt type eaddr.
The number returned is your Ethernet address.

METHOD 3:  arp

You can obtain the Ethernet address of a Silicon Graphics system by using
another system on your network. From that system ping the system you want
the Ethernet address of. Stop the ping and issue /usr/etc/arp <hostname>
where <hostname> is the name of the system you want to obtain the Ethernet
address of. This will return the Ethernet address as in the following
example:

% /usr/etc/ping luey6
PING luey6.sgi.com (192.48.200.250): 56 data bytes
64 bytes from 192.48.200.250: icmp_seq=0 ttl=255 time=0 ms
64 bytes from 192.48.200.250: icmp_seq=1 ttl=255 time=0 ms
64 bytes from 192.48.200.250: icmp_seq=2 ttl=255 time=0 ms
^c
----luey6.sgi.com PING Statistics----
3 packets transmitted, 3 packets received, 0% packet loss
round-trip (ms)  min/avg/max = 0/0/0
% /usr/etc/arp luey6
luey6 (192.48.200.250) at 8:0:69:6:c:40
%


4DDN: A Special Case

4DDN is Silicon Graphics' DECnet interconnection product. The Ethernet
address of an IRIS running 4DDN will change when 4DDN is started.

DECnet uses a one-to-one relationship between the DECnet node ID and the
Ethernet address. If the DECnet address is changed the Ethernet address is
changed. DECnet Ethernet addresses always start with aa: to allow you to
identify systems running DECnet when you use the arp -a command.
will return the original Ethernet address for the system. Methods 2 and 3
will show the Ethernet address currently in use.

------------------------------

Subject:   -16- Security problem with pre-IRIX4.0.5 'lp'
Date: 20 May 93 00:00:01 CST

Ref:  Cert Advisory CA-92:08

Thanks to Dave Olson ([e-mail]) for this one:

Attached please find a patch for a security problem found in all
versions of IRIX.  This vulnerability is *not* present in any
version of the Trusted IRIX/B product.

The problem was found (by SGI employees) by inspection
of the lp spooling system in response to recent postings on
comp.sys.sgi.  Note that this is not inherently a problem in
having an open lp account (no password), but rather a
configuration problem on the part of Silicon Graphics.  I have
heard (shortly after we found it ourselves) from only one
customer who has independently found this problem, so presumably
it isn't widely known yet.  Other Unix versions derived from early
S5R3 releases may (or may not) have similar problems.

No files need to be replaced, just modes changed to remove
set[gu]id bits, and writability of some files.  The commands to
do so are part of the attachment below.

The body of the attachment below has also been submitted to CERT
(Computer Emergency Response Team) for publication by them; it
may be published in an altered form.

To those who have been discussing security problems on
comp.sys.sgi, I (personally, not speaking for SGI) apologize for
not being able to disclose this earlier in my replies.  We have
only known about this for a matter of days, and needed to do
some testing to be sure we weren't introducing any problems by
the use of this fix.  I hope that my postings over the last few
days will be interpreted as they were written, and not as an
attempt to lull people into believing that no problems existed.

===========================================================================

I.   DESCRIPTION:

     A vulnerability exists such that IRIX pre-4.0.5 systems
     with the basic system software ("eoe1.sw.unix") or the
     system manager software ("eoe2.sw.vadmin") installed can
     allow unauthorized access to the superuser account, by
     exploiting a configuration error in standard system
     utilities. Due to the ease of exploiting this vulnerability
     and the simplicity of the corrective action, the CERT/CC
     urges all sites to install the patch given below.

II.  IMPACT:

     Anyone who can login as (or su to) the user "lp" can become
     root on any pre-IRIX 4.0.5 system. As Irix is normally
     distributed, this includes any ordinary user

III. SOLUTION:

     As "root", execute the following commands:

    cd /usr/lib
    chmod a-s,go-w lpshut lpmove accept reject lpadmin
    chmod go-ws lpsched vadmin/serial_ports vadmin/users vadmin/disks
    cd /usr/bin
    chmod a-s,go-w disable enable
    chmod go-ws cancel lp lpstat

     If the eoe2.sw.vadmin software is not installed, you may
     get messages like:
       "chmod: WARNING: can't access vadmin/serial_ports"
     These can be ignored if they occur.

     If system software should ever be reloaded from pre-4.0.5
     media or from a backup tape created before the patch was
     applied, repeat the above procedure immediately after the
     software has been reloaded, before enabling logins by
     normal users.

     [ Fixed in IRIX 4.0.5 ]

------------------------------

Subject:   -17- Why isn't /usr/adm/SYSLOG isn't being updated?
Date: 20 May 93 00:00:01 CST

Thanks to Vernon Schryver ([e-mail]) here.

Popular causes include:

    -running out of disk space.
        Once syslogd is unable to write to /usr/adm/SYSLOG,
        it won't try again until it is `killall -HUP syslogd`.

    -installing IRIX 4.0.X and failing to heed the nagging from
    the system when it is rebooted to run 'versions changed'
    and combine new and old configuration files.  In this
    case, the trouble is in /usr/spool/cron/crontabs/root.



------------------------------

Subject:   -18- Credits
Date: 6 May 93 00:00:01 EST

The comp.sys.sgi FAQs are the collective effort of

  Dale Chayes        [e-mail]
  Steve Rikli        [e-mail]
  Allan Schaffer    [e-mail]
  Dave Schweisguth    [e-mail]

Special thanks are due to

  Tom Davis        Author of 'zip'
  Harry Mangalam    Maintainer of the comp.sys.sgi.* WAIS database

Finally, much thanks to all of the SGI employees on Usenet, all of whom have
provided gigabytes of help and information.

Credits for individual contributions are given in the answers.

------------------------------
--
Allan Schaffer
[e-mail]
--
Allan Schaffer
[e-mail]