SUMMARY:Insight Manager on Tru64 4.0g

From: Karen R. McArthur <kmcarthu_at_bates.edu>
Date: Tue, 12 Jun 2001 10:02:06 -0400

This list is GREAT! Thanks for all the quick responses.

I found this software after installing 4.0g, but others have found it in
4.0f (we skipped over that version). General consensus is to disable
Insight Manager due to bugs (see www.securityfocus.com -> search BUGTRAQ
for -> insight manager).

There are a few ways to disable this:
1.) if you have applied patch of at least CPQIM211, you can disable it in
/etc/rc.config with INSIGHTD_CONF="no"
2.) move the insightd script out of /sbin/init.d
3.) close port 2301
4.) rename /sbin/rc3.d/S..insight... to something "non-startable"

In all of these scenarios, you will probably need to shut down the currently
running insightd (/sbin/init.d/insightd stop).

Many thanks to J. Bacher, sysadmin_at_astro.su.se, Nikola Milutinovic and
Edward J. Branley.

--
Karen R. McArthur, System Administrator
Bates College: Library & Information Services, Network & Infrastructure
110 Russell Street, Lewiston, Maine 04240 USA
ph:207-786-8236 fax:207-786-6057 email:kmcarthu_at_bates.edu
==================================================
>Excuse the "newbie" slant on this email, but I can't find the information I
>need on the Compaq web site.
>
>We recently upgraded our Alpha 4100 from Digital Unix 4.0d to Tru64 4.0g in
>preparation for the end of 4.0d support June 30th.  This morning I received
>a report from Tripwire that some pages in /var/im have been changed.  First
>of all, I didn't realize that Insight Manager had been installed by default
>with 4.0g.  Second, I didn't configure it when it was installed.  Third, I
>didn't touch those files to trigger Tripwire.
>
>My question is this - what security holes has Insight Manager opened up on
>my Alpha - and how can I close them?  Also, where can I find the
>documentation on this?  All I've been able to find are the sales pages.
Any
>help would be appreciated.

Received on Tue Jun 12 2001 - 14:08:26 NZST