[3242] in SIPB-AFS-requests
Re: migrating rosebud to a Sun
daemon@ATHENA.MIT.EDU (mhpower@MIT.EDU)
Tue Jan 19 14:00:28 1999
Date: Tue, 19 Jan 1999 14:00:20 -0500
From: mhpower@MIT.EDU
To: mwhitson@MIT.EDU
Cc: sipb-afsreq@MIT.EDU, zacheiss@MIT.EDU, hartmans@MIT.EDU
In-Reply-To: "[3238] in SIPB-AFS-requests"
> /afs/sipb/service/afs/mkserv/sipbops.*
>
>Anyone who would like to review these and recommend changes ...
My main comments are:
-- the existing Sun afs servers allow telnet logins with
"telnet -a user". This has been my preferred method of logging
into an afs server. I think it should continue to work, unless
we later decide to allow only ssh.
-- to allow only root to login, I believe it is safest to
create an empty /etc/athena/access file
-- since you are not running any services from the Sun inetd, it
would seem consistent with the idea of not running any unnecessary
network daemons to not run /usr/sbin/inetd
-- since I'm modifying /etc/init.d/inetsvc anyway to shut off
the Sun inetd, I decided to also remove the superfluous sleep
statement
Matt
*** sipbops.add.old Tue Jan 19 01:25:13 1999
--- sipbops.add Tue Jan 19 13:50:21 1999
***************
*** 7,10 ****
--- 7,13 ----
mach=`/bin/athena/machtype`
+ SIPBTOP=/afs/sipb.mit.edu/service/solaris
+ SIPBCF=$SIPBTOP/cf
+ SIPBCBIN=$SIPBTOP/bin
# do we update /etc/athena/inetd.conf or /etc/inetd.conf
***************
*** 58,61 ****
--- 61,66 ----
echo $N "Editing $INETDIR/inetd.conf...$C"
sed -n -e '/^[a-z]/s/^/#/' \
+ -e '/telnet/s/^#//' \
+ -e '/telnet/s/cred/user/' \
-e '/eklogin/s/^#//' \
-e '/kshell/s/^#//' \
***************
*** 67,71 ****
-e 's/unun/un/' \
-e '/globalmessage/d' \
! -e p /srvd$INETDIR/inetd.conf > /tmp/inetd.conf
test -f $INETDIR/inetd.conf.old || mv -f $INETDIR/inetd.conf $INETDIR/inetd.conf.old
--- 72,76 ----
-e 's/unun/un/' \
-e '/globalmessage/d' \
! -e p /$SIPBCF$INETDIR/inetd.conf > /tmp/inetd.conf
test -f $INETDIR/inetd.conf.old || mv -f $INETDIR/inetd.conf $INETDIR/inetd.conf.old
***************
*** 112,115 ****
--- 117,131 ----
fi
+ $SIPBCBIN/comment-out /etc/init.d/inetsvc << _END_INETD_COMMENT_
+ /usr/sbin/inetd -s
+ _END_INETD_COMMENT_
+
+ $SIPBCBIN/comment-out /etc/init.d/inetsvc << _END_SLEEP_COMMENT_
+ sleep 5
+ _END_SLEEP_COMMENT_
+
+ # Make sure only root may log in
+ cp /dev/null /etc/athena/access
+
exit 0
