Nebula 1994 June/NEBULA_SE.ISO/Documents/FAQ/SGI-faq/faq/admin

Internet Message Format | 1993-07-15 | 21.0 KB

Path: senator-bedfellow.mit.edu!bloom-beacon.mit.edu!usc!elroy.jpl.nasa.gov!ames!sgi!fido.asd.sgi.com!holodeck.csd.sgi.com!aschaffe
From: [e-mail] (Allan Schaffer)
Newsgroups: comp.sys.sgi.misc,comp.sys.sgi.admin,comp.sys.sgi.apps,comp.sys.sgi.bugs,comp.sys.sgi.graphics,comp.sys.sgi.hardware,comp.answers,news.answers
Subject: SGI admin Frequently Asked Questions (FAQ)
Supersedes: <[e-mail]>
Followup-To: comp.sys.sgi.misc
Date: 15 Jul 1993 07:01:00 GMT
Organization: Silicon Graphics, Inc., Mountain View, CA
Lines: 539
Approved: [e-mail]
Expires: 13 Aug 1993 07:01:01 GMT
Message-ID: <[e-mail]>
References: <[e-mail]>
Reply-To: [e-mail]
NNTP-Posting-Host: holodeck.csd.sgi.com
Originator: [e-mail]
Xref: senator-bedfellow.mit.edu comp.sys.sgi.misc:3349 comp.sys.sgi.admin:2209 comp.sys.sgi.apps:1071 comp.sys.sgi.bugs:1110 comp.sys.sgi.graphics:1593 comp.sys.sgi.hardware:1775 comp.answers:1309 news.answers:10356


Archive-name: sgi/faq/admin

           SGI admin Frequently Asked Questions (FAQ)


This information is freely distributable and wide circulation is encouraged.
The contents are accurate as far as we know, but the usual disclaimers apply.
This FAQ contains errors! Finding them is an exercise for alert readers.

Please send additions and changes to [e-mail].

This FAQ is one of the SGI FAQ series, which consists of:

     SGI Admin FAQ - IRIX System Administration
     SGI Apps FAQ - Applications & Compilers
     SGI Graphics FAQ - Graphics & Windowing
     SGI Hardware FAQ - Hardware issues
     SGI Misc FAQ - Introduction & Miscellaneous Information

Each FAQ is posted to each comp.sys.sgi.* group as well as the news.answers
and comp.answers newsgroups (whose purpose is to store FAQs) every two weeks.
If you can't find one of the FAQs with your news program, you can get it by
anonymous FTP from one of these sites:

 rtfm.mit.edu:pub/usenet/news.answers/sgi/faq/admin
 rtfm.mit.edu:pub/usenet/comp.sys.sgi.misc/SGI_admin_Frequently_Asked_Questions
 archone.tamu.edu:ftp/pub/sgi/faq/admin
 rtfm.mit.edu:pub/usenet/comp.answers/sgi/faq/admin

Note that rtfm.mit.edu is home to many other FAQs and informational documents,
and is a good place to look if you can't find an answer here.

Topics covered in this FAQ:
--------------------------
  -1- How can I quickly find the question I want in this FAQ?
  -2- Is it possible to use a system with graphics to run the Visual System
      Manager ('vadmin') on a system without graphics?
  -3- Is it possible to boot from a CD-ROM?
  -4- Is it possible to remotely install IRIX over a network?
  -5- What is the most current release of IRIX for my machine?
  -6- How can I track failed login attempts on my system?
  -7- I've configured 'tftp' in /usr/etc/inetd.conf--why isn't it working?
  -8- Is 'pcnfsd' available for the SGI?
  -9- Is there an easy way to determine which release of IRIX I'm running?
  -10- How do I set the number of processes allowed on my machine?
  -11- I think I've found a security hole in IRIX; who do I notify at SGI?
  -12- I want to install a termcap for 'iris-ansi-net' on my non-SGI system,
       but I can't find a termcap file on the SGI.  Where can I get one?
  -13- My SGI crashed and generated a file, /usr/adm/crash/vmcore.1 .  How can
       I examine this file to see what crashed my system?
  -14- Why can't I export an NFS-mounted filesystem?
  -15- Why is my network license daemon ('netlsd') exiting?
  -16- How do I log anonymous ftp sessions?
  -17- How can I determine my SGI's unique ethernet hardware address?
  -18- Security problem with pre-IRIX4.0.5 'lp'
! -19- Why isn't /usr/adm/SYSLOG being updated?
+ -20- Why is 'rusers' showing users who aren't really logged in?
+ -21- How do I make a bootable tape from an IRIX 4.0.X CD?
  -22- Credits

----------------------------------------------------------------------

Subject:   -1- How can I quickly find the question I want in this FAQ?
Date: 27 May 93 00:00:01 EST

- This FAQ follows the RFC1153 recommendations for message digests and thus
  can be viewed easily with newsreaders that understand message digests.
- Each question has a Subject: line, so you can easily step through the answers
  with rn's ^G command.
- Each question is marked with a "dash number dash" so that you can find any
  answer with a simple search pattern.
- Questions marked with a '+' are new this posting; those marked with a '!'
  have significant new content since the last edition.

------------------------------


Subject:   -2- Is it possible to use a system with graphics to run the Visual System
               Manager ('vadmin') on a system without graphics?
Date: 20 May 93 00:00:01 CST

Yes.  Make sure the DISPLAY environment variable is set correctly, and the
shared libraries must be installed on the graphic-less system (which is the
default installation), along with all the eoe2.sw.vadmin stuff.

------------------------------

Subject:   -3- Is it possible to boot from a CD-ROM?
Date: 20 May 93 00:00:01 CST

Yes, for systems with new PROMs, such as Indigo and Crimson, it can be done.
For older systems it can be done with the SGI CD-ROM drive, but it can get
frustrating in some cases.  For some older systems, it may be necessary to
use either a local tape drive, or boot them over the network.

------------------------------

Subject:   -4- Is it possible to remotely install IRIX over a network?
Date: 20 May 93 00:00:01 CST

Yes.  There are several different ways to do this:
        - from a remote machine with a CD-ROM
        - from a remote machine with a tape drive
        - from a remote machine with an IRIX distribution directory

All of these scenarios (and several others) are described in detail in the
"IRIS Software Installation Guide".  Examples are provided.

------------------------------

Subject:   -5- What is the most current release of IRIX for my machine?
Date: 20 May 93 00:00:01 CST

This changes quite often.  As of this writing:

    Indigos:  IRIX 4.0.5f
    Onyx/Challenge:  IRIX 5.*
    others:  IRIX 4.0.5a

------------------------------

Subject:   -6- How can I track failed login attempts on my system?
Date: 20 May 93 00:00:01 CST

Put syslog=all in /etc/cofig/login.options, as described in 'man login'.

Add logging arguments to lines in /usr/etc/inetd.conf, as directed by
the man pages for the daemons in question.

------------------------------

Subject:   -7- I've configured 'tftp' in /usr/etc/inetd.conf--why isn't it working?
Date: 20 May 93 00:00:01 CST

The command in /usr/etc/inetd.conf that starts up tftpd is:
tftp    dgram   udp     wait    guest   /usr/etc/tftpd  tftpd -s /usr/local/boot

Or something similar.  Changes made to this line will NOT take effect until
you do (as root) 'killall -HUP inetd', or reboot.

------------------------------

Subject:   -8- Is 'pcnfsd' available for the SGI?
Date: 20 May 93 00:00:01 CST

Yes.  A binary and man page are available via anonymous ftp from sgi.com, in
/pub/pcnfsd.tar .  It is unsupported, as the included README disclaimer
will tell you.

------------------------------

Subject:   -9- Is there an easy way to determine which release of IRIX I'm running?
Date: 20 May 93 00:00:01 CST

'uname -a' gives you all the kernel info; see 'man uname' for other options.

Of more general use, since kernels don't always reflect installed software, is
the 'versions' command.  'versions' with no arguments lists all the installed
software subsystems.

------------------------------

Subject:   -10- How do I set the number of processes allowed on my machine?
Date: 20 May 93 00:00:01 CST

Change /usr/sysgen/master.d/kernel, run '/etc/autoconfig -f', reboot.

------------------------------

Subject:   -11- I think I've found a security hole in IRIX; who do I notify at SGI?
Date: 20 May 93 00:00:01 CST

In general, if you find a security problem (or think you have), you can send
it to [e-mail] .

You can also notify CERT ([e-mail]), and they will contact the appropriate
people from their contact list.

------------------------------

Subject:   -12- I want to install a termcap for 'iris-ansi-net' on my non-SGI system,
                but I can't find a termcap file on the SGI.  Where can I get one?
Date: 20 May 93 00:00:01 CST

SGIs use the system 5 style terminfo stuff.  What you want can be done though.
See 'man infocmp', and the documentation about -r.  This should do the job:
'infocmp -Cr iris-ansi'.

If you don't have infocmp, you have to install eoe2.sw.terminf, which is not
installed by default.

------------------------------

Subject:   -13- My SGI crashed and generated a file, /usr/adm/crash/vmcore.1 .  How can
                I examine this file to see what crashed my system?
Date: 20 May 93 00:00:01 CST

dbx -k /usr/adm/crash/{unix,vmcore}.#
t
&putbuf/1000s

Is a reasonable starting sequence.  The Technical Assistance Center (TAC) has some
scripts that they have customers run to provide more info in some cases.

------------------------------

Subject:   -14- Why can't I export an NFS-mounted filesystem?
Date: 20 May 93 00:00:01 CST

This is known as multi-hop NFS and is not allowed/supported in (Sun's) NFS.  SGI
decided in IRIX 4.0.X it was better to prevent attempts to export NFS-mounted
filesystems than to catch the error on client access.

------------------------------

Subject:   -15- Why is my network license daemon ('netlsd') exiting?
Date: 20 May 93 00:00:01 CST

For netlsd to run, you need to have 'llbd' and 'glbd' installed and running.  A
complete debugging procedure is in the netls release notes, which can be read with
'relnotes netls_eoe 5'.

------------------------------

Subject:   -16- How do I log anonymous ftp sessions?
Date: 20 May 93 00:00:01 CST

The IRIX 4.0.X 'ftpd' will make additional entries to the syslog with the '-l'
option.  'ftpd -ll' will keep an accounting of how many times a file is requested
and by whom, and 'ftpd -lll' will log the number of bytes transferred as well.
'man ftpd' for more details.

------------------------------

Subject:   -17- How can I determine my SGI's unique ethernet hardware address?
Date: 20 May 93 00:00:01 CST

There are several ways to do this.  Many thanks to [e-mail], for
providing this robust answer and discussion:

Determining Your System's Address(es): Ethernet versus Internet Protocol

The physical Ethernet address of your system is the unique number assigned
to the Ethernet hardware on your system and is not to be confused with the
IP address which can be set. This unique number is assigned to the
manufacturer of your Ethernet hardware by the IEEE, (previously assigned by
Xerox, one of the original developers of Ethernet). Every system on an
Ethernet network must have a unique Ethernet address for the network to
operate properly.

You may need to determine your system's Ethernet address if your network
manager requires it before connecting your system to a network.

There are several ways to obtain the Ethernet address, depending on whether
IRIX is running and what operating system version is loaded.

Methods 1 and 2 will only provide the Ethernet address of the Primary
interface. If you have multiple Ethernet interfaces (boards) in a system,
use Method 3 or Method 4 to determine the address(es) of any other
interface(s).


METHOD 1:  eaddr

If IRIX is not running, and the system is an Indigo (4DRPC) or Personal IRIS
(4D20, 4D25, 4D30, 4D35), you may obtain the Ethernet address by typing
eaddr at the prom monitor prompt. Instead of booting the system, press the
escape key to go to the System Maintenance menu. Select 5 for the Command
Monitor mode. At the >> prompt type eaddr. The number returned is your
Ethernet address.


METHOD 2:  sysinfo

If IRIX 3.3.X or 4.0.X is running, you can use the sysinfo command. This
command will return a series of numbers that will provide all or part of the
Ethernet address depending on the type of system.

On Indigo and Personal IRIS systems (4DRPC, 4D20, 4D25, 4D30, 4D35) sysinfo
will return part of the Ethernet address. For example:

% /etc/sysinfo

System ID:
69  06  0c  40  00  00  00  00  00  00  00  00  00  00  00  00
00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00
00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00
00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00

In this case, the last 4 parts of the address are displayed. The first 2
parts are 08 and 00 (since this is the block of addresses assigned to
Silicon Graphics). This system's Ethernet address is 08:00:69:06:0c:40.

On Power Series systems (4D50, 4D60, 4D70, 4D80, 4D1xx, 4D2xx, 4D3xx,
4D4xx), sysinfo will return the entire Ethernet address but it is intermixed
with other numbers. For example:

% /etc/sysinfo

System ID:
08  2c  00  3e  69  50  02  62  10  74  d1  86  8f  98  a1  aa
b3  bc  c5  ce  d7  e0  e9  f2  fb  04  0d  16  1f  28  31  3a
43  4c  55  5e  67  70  79  82  8b  94  9d  a6  af  b8  c1  ca
d3  dc  e5  ee  f7  00  09  12  1b  24  2d  36  3f  48  51  5a

Reading the first column and every other column reveals the Ethernet address
08:00:69:02:10:d1 for this system.


METHOD 3:  arp

You can obtain the Ethernet address of a Silicon Graphics system by using
another system on your network. From that system ping the system you want
the Ethernet address of. Stop the ping and issue /usr/etc/arp <hostname>
where <hostname> is the name of the system you want to obtain the Ethernet
address of. This will return the Ethernet address as in the following
example:

% /usr/etc/ping luey6
PING luey6.sgi.com (192.48.200.250): 56 data bytes
64 bytes from 192.48.200.250: icmp_seq=0 ttl=255 time=0 ms
64 bytes from 192.48.200.250: icmp_seq=1 ttl=255 time=0 ms
64 bytes from 192.48.200.250: icmp_seq=2 ttl=255 time=0 ms
^c
----luey6.sgi.com PING Statistics----
3 packets transmitted, 3 packets received, 0% packet loss
round-trip (ms)  min/avg/max = 0/0/0
% /usr/etc/arp luey6
luey6 (192.48.200.250) at 8:0:69:6:c:40
%

METHOD 4:  netstat

If you are running version 4.0.X of IRIX, you can use the netstat command to
obtain your Ethernet address. For example:

% /usr/etc/netstat -ia

Name  Mtu    Network   Address            Ipkts   Ierrs   Opkts  Oerrs  Coll
ec0   1500   siligrph  luey7              7765678 21648  384477     0  30338
                        192.48.200.251
                        192.0.0.1
                        08:00:69:06:17:c2
lo0   32880  loopback localhost           41438       0   41438     0      0
                        192.0.0.1

In the preceding example the Ethernet address of the system luey7 is
08:00:69:06:17:c2 as seen on the fourth address line for the primary
Ethernet interface ec0.


4DDN: A Special Case

4DDN is Silicon Graphics' DECnet interconnection product. The Ethernet
address of an IRIS running 4DDN will change when 4DDN is started.

DECnet uses a one-to-one relationship between the DECnet node ID and the
Ethernet address. If the DECnet address is changed the Ethernet address is
changed. DECnet Ethernet addresses always start with aa: to allow you to
identify systems running DECnet when you use the arp -a command.
will return the original Ethernet address for the system. Methods 3 and 4
will show the Ethernet address currently in use.

------------------------------

Subject:   -18- Security problem with pre-IRIX4.0.5 'lp'
Date: 20 May 93 00:00:01 CST

Ref:  Cert Advisory CA-92:08

Thanks to Dave Olson ([e-mail]) for this one:

Attached please find a patch for a security problem found in all
versions of IRIX.  This vulnerability is *not* present in any
version of the Trusted IRIX/B product.

The problem was found (by SGI employees) by inspection
of the lp spooling system in response to recent postings on
comp.sys.sgi.  Note that this is not inherently a problem in
having an open lp account (no password), but rather a
configuration problem on the part of Silicon Graphics.  I have
heard (shortly after we found it ourselves) from only one
customer who has independently found this problem, so presumably
it isn't widely known yet.  Other Unix versions derived from early
S5R3 releases may (or may not) have similar problems.

No files need to be replaced, just modes changed to remove
set[gu]id bits, and writability of some files.  The commands to
do so are part of the attachment below.

The body of the attachment below has also been submitted to CERT
(Computer Emergency Response Team) for publication by them; it
may be published in an altered form.

To those who have been discussing security problems on
comp.sys.sgi, I (personally, not speaking for SGI) apologize for
not being able to disclose this earlier in my replies.  We have
only known about this for a matter of days, and needed to do
some testing to be sure we weren't introducing any problems by
the use of this fix.  I hope that my postings over the last few
days will be interpreted as they were written, and not as an
attempt to lull people into believing that no problems existed.

===========================================================================

I.   DESCRIPTION:

     A vulnerability exists such that IRIX pre-4.0.5 systems
     with the basic system software ("eoe1.sw.unix") or the
     system manager software ("eoe2.sw.vadmin") installed can
     allow unauthorized access to the superuser account, by
     exploiting a configuration error in standard system
     utilities. Due to the ease of exploiting this vulnerability
     and the simplicity of the corrective action, the CERT/CC
     urges all sites to install the patch given below.

II.  IMPACT:

     Anyone who can login as (or su to) the user "lp" can become
     root on any pre-IRIX 4.0.5 system. As Irix is normally
     distributed, this includes any ordinary user

III. SOLUTION:

     As "root", execute the following commands:

    cd /usr/lib
    chmod a-s,go-w lpshut lpmove accept reject lpadmin
    chmod go-ws lpsched vadmin/serial_ports vadmin/users vadmin/disks
    cd /usr/bin
    chmod a-s,go-w disable enable
    chmod go-ws cancel lp lpstat

     If the eoe2.sw.vadmin software is not installed, you may
     get messages like:
       "chmod: WARNING: can't access vadmin/serial_ports"
     These can be ignored if they occur.

     If system software should ever be reloaded from pre-4.0.5
     media or from a backup tape created before the patch was
     applied, repeat the above procedure immediately after the
     software has been reloaded, before enabling logins by
     normal users.

     [ Fixed in IRIX 4.0.5 ]

------------------------------

Subject: ! -19- Why isn't /usr/adm/SYSLOG being updated?
Date: 05 Jul 93 00:00:01 CST

Thanks to Vernon Schryver ([e-mail]) here.

Popular causes include:

    -running out of disk space.
        Once syslogd is unable to write to /usr/adm/SYSLOG,
        it won't try again until it is `killall -HUP syslogd`.

    -installing IRIX 4.0.X and failing to heed the nagging from
    the system when it is rebooted to run 'versions changed'
    and combine new and old configuration files.  In this
    case, the trouble is in /usr/spool/cron/crontabs/root.

------------------------------

Subject: + -20- Why is 'rusers' showing users who aren't really logged in?
Date: 05 Jul 93 00:00:01 CST

This is a well-known bug in IRIX 4.0.X wherein /etc/utmp is not being
updated properly after a user logout.  'rusers' (and other programs) are
simply reporting the non-updated contents of /etc/utmp.

Several user-contributed fixes are available.  Our thanks for this one
goes to [e-mail], and it may be obtained at:

        archone.tamu.edu:/pub/sgi/fixes/cleanutmp.tar.Z

Thanks to David Hinds ([e-mail]) for this fix:

    archone.tamu.edu:/pub/sgi/fixes/fixutmp.tar.Z

And also to Patrick M. Ryan ([e-mail]) for this version:

    archone.tamu.edu:/pub/sgi/fixes/utmpfix.tar.Z

Compilation and installation instructions are included.  Note that there
are others available; if authors of similar (or other) fixes would like to
provide them to the SGI community, please contact [e-mail],
and we would be only too happy to include it in the FAQ and the anonymous
FTP archive.

------------------------------

Subject: + -21- How do I make a bootable tape from an IRIX 4.0.X CD?
Date: 05 Jul 93 00:00:01 CST

Thanks to Dave Olson for this summary:

Take a look at the distcp(1M) man page.

    tapehost# mount -o ro cdhost:/CDROM /mnt
    tapehost# distcp /mnt/dist /dev/nrtape

Note that fx, ide, and sash for all machines are in the dist/sa file.
sa is an image of the first part of the tape; use 'mkbootape -f sa -l'
to see the contents.


------------------------------

Subject:   -22- Credits
Date: 6 May 93 00:00:01 EST

The comp.sys.sgi FAQs are the collective effort of

  Dale Chayes        [e-mail]
  Steve Rikli        [e-mail]
  Allan Schaffer    [e-mail]
  Dave Schweisguth    [e-mail]

Special thanks are due to

  Tom Davis        Author of 'zip'
  Harry Mangalam    Maintainer of the comp.sys.sgi.* WAIS database

Finally, much thanks to all of the SGI employees on Usenet, all of whom have
provided gigabytes of help and information.

Credits for individual contributions are given in the answers.

------------------------------
--
Allan Schaffer
[e-mail]
--
Allan Schaffer
[e-mail]