🚀 go-pugleaf

In article <7270177653140@skeeve.mcs.anl.gov> rackow@skeeve.mcs.anl.gov (Gene Rackow) writes:
>It sounds like your running SunOS 4.0.0 to be complaining like you are karl.
>Yes, rcp.lockd is and has been a problem, but as to file servers, I have
>been using a few Sun3/280's and then more recently moved to Sparc-2's.

4.0.3, 4.1.0, 4.1.1, and now 4.1.2.  All with problems.  On machines from 
Sparc 1s to 4/630 MPs (does anyone other than me think those extra 
processors are a joke until Solaris 2.1 is working well enough to move 
to?)

rpc.lockd is the most horrid botch I have seen.  Other vendors can get 
this right.  Why does Sun consistently get it wrong?  I have seen over <10>
different versions and patches of this daemon (and its kernel support) in
the last 3 years, with two coming a whole week or so apart.

Is it <that> hard to do right?

>As to network utilization, we used to have an average of 40% of bandwidth
>on the backbone cable with peaks of 80-100% lasting for 10-20seconds.
>Ever see a cabletron box with ALL the port lights on solid?

Frequently.

Did you have fun with the crappy VM implementation on 4.1.[01]?  The one
which allowed you to bring a 4/490 to tears with a single Sparcstation
client running NFS?

>If you are worried about NIS being a security hole, I suppose that don't
>run it.  You've come up with something better?  NFS is also a security
>hole, probably even bigger than NIS.  Did you replace that as well?

You can block NFS at a router easily.  NIS isn't so easy.  (Hint: blocking
the portmapper isn't enough).  SOME machines, such as the MIPS line, will
refuse to allow a mount of a disk which doesn't answer a reverse-name 
query (which you can ALSO block effectively)

>Name vendors that are doing the right things and have been shipping for
>a few years.  Unix has some security problems that need to be addressed,
>but if it wasn't for tools like NFS, NIS/YP, sendmail, usenet, and others
>we'd probably be sitting in front of card punches attempting to change
>some line of JCL somewhere.
>
>--Gene
>
>PS: Some things can be done to tighten down security if you'd like.
>Get the tcp_wrap package from cert.org, and the securelib package
>from eecs.nwu.edu.  These will tighten the security of the daemons
>and the inet started processes by some amount. Basicly restricting them
>to the networks you choose, and/or logging transactions.

Does nothing, however, for UDP, which is where many of the security 
problems are.

Sun isn't the worse vendor out there.  But they do have a long way to go.

--
Karl Denninger (karl@ddsw1.MCS.COM, <well-connected>!ddsw1!karl)
Data Line: [+1 312 248-0900]