[HPADM] Summary: Unusual Problem

From: Johnson, Craig E (Craig.E.Johnson_at_icn.siemens.com)
Date: 08/13/03

  • Next message: Hazari Shyam (WQQ1SXH): "[HPADM] Summary: ct_query - EMC disks with NO_HW" 
    To: "'hpux-admin@DutchWorks.nl'" <hpux-admin@DutchWorks.nl>
Date: Wed, 13 Aug 2003 08:27:23 -0700

    Thanks to all who responded. My question concerned a pingable machine that
    wouldn't respond to telnet, ftp, or traceroute. This turned out to be IPSec
    related, something I'm totally unfamiliar with. I've attached the offending
    script below, which was being executed at startup after being called by
    another S99.... script. Note the "block all incomming" line (I've found
    this elsewhere as well, same programmer, same spelling error):
     
    #!/usr/bin/ksh

    # add after rtp start-up

    IPSEC_CMD=/tmp/IpsecCmd$$

    echo \# Allow Name server >>$IPSEC_CMD

    if [ -f /etc/resolv.conf ]

    then

    grep "^nameserver" /etc/resolv.conf | awk '{

    printf ( "{ saddr %s } bypass { dir in } \n", $2);

    }'

    fi >$IPSEC_CMD

    echo \# Allow all out-going >>$IPSEC_CMD

    echo { } bypass { dir out } >>$IPSEC_CMD

    echo { saddr `uname -n` } bypass { dir in } >>$IPSEC_CMD

    echo { saddr 127.0.0.1 } bypass { dir in } >>$IPSEC_CMD

    echo >>$IPSEC_CMD

    echo \# Block all incomming >>$IPSEC_CMD

    echo { } permit { dir in encr_algs DES } >>$IPSEC_CMD

    echo >>$IPSEC_CMD

    echo \# Let SSH in >>$IPSEC_CMD

    echo { dport 22 } bypass { dir in } >>$IPSEC_CMD

    echo { sport 22 } bypass { dir in } >>$IPSEC_CMD

    echo >>$IPSEC_CMD

    echo \# Allow NTP server >>$IPSEC_CMD

    if [ -f /etc/inet/ntp.conf ]

    then

    grep "^server" /etc/inet/ntp.conf | awk '{

    printf ( "{ saddr %s dport 123 } bypass { dir in } \n", $2);

    }'

    fi >>$IPSEC_CMD

    if [ -f /etc/bootparams ]

    then

    cat /etc/bootparams | grep -v "^#" | awk '{

    printf( "{ saddr %s } bypass { dir in } \n", $1 );

    }'

    fi >>$IPSEC_CMD

    echo \# Allow trusted hosts >>$IPSEC_CMD

    if [ -f /export/home/sis/.AllowList ]

    then

    cat /export/home/sis/.AllowList | awk '{

    if ( NF == 2 )

    {

    printf ( "{ saddr %s dport %s } bypass { dir in } \n", $1, $2);

    } else

    {

    printf ( "{ saddr %s } bypass { dir in } \n", $1);

    }

    }'

    fi >>$IPSEC_CMD

     

    /usr/sbin/ipsecconf -f

    /usr/sbin/ipsecconf -a $IPSEC_CMD -q

    rm $IPSEC_CMDpsecconf -a $IPSEC_CMD -q

    rm $IPSEC_CMD

     

    Craig Johnson
    Systems Administrator/Sr. Engineer
    Siemens

      

    --
             ---> Please post QUESTIONS and SUMMARIES only!! <---
        To subscribe/unsubscribe to this list, contact majordomo@dutchworks.nl
       Name: hpux-admin@dutchworks.nl     Owner: owner-hpux-admin@dutchworks.nl
 
 Archives:  ftp.dutchworks.nl:/pub/digests/hpux-admin       (FTP, browse only)
            http://www.dutchworks.nl/htbin/hpsysadmin   (Web, browse & search)
  • Next message: Hazari Shyam (WQQ1SXH): "[HPADM] Summary: ct_query - EMC disks with NO_HW"

    Relevant Pages