FAQ for IBM AIX

Table of Contents
1. AIX
1.0 General concepts
1.1 SMIT, system administration
1.2 Backups, tape
1.3 Memory and process management
1.4 Shells, commands, man pages, InfoExplorer
1.5 Video, Graphics, X11
1.6 Networks and communications
1.7 LVM
1.8 AIX 4.x
1.9 Miscellaneous

HTML-ized and updated: Fri Oct 1 10:41:04 EDT 1999



General Info about this FAQ
This posting contains frequently asked questions and answers about the IBM RS/6000 series workstations and AIX versions 3 and 4. All input is very welcome, The list is split into five articles to pass thru most mailers. I’ll usually try to post them once a month to comp.unix.aix, news.answers, and comp.answers. Please let your input continue as I am most thankful for all of it.
Please make a note of the fact that these sites contain more than just the AIX FAQ and would probably be worth consulting before you post questions to any of the usenet groups. If you see a From: line it means that whatever follows is either an unabridged or slightly edited version of the input I have received, and that I may not have verified its contents. If there is no From: line, I probably know what I am talking about, and the entry is edited from various sources. All entries are numbered with major and minor subject number, e.g. 2.11. If the subject is preceded by an asterisk, that entry has been changed or added since the last posting. The comp.unix.aix group is for AIX on all IBM platforms -- RT, PS/2, 370, RS/6000 and mainframes (ESA based on OSF/1), but the traffic has evolved to discuss predominantly AIX 3.x and the RS/6000. The newsgroups comp.sys.ibm.pc.rt and comp.sys.ibm.ps2.hardware cover the RT, mostly hardware and AOS 4.3, and on PS/2 hardware respectively. Mark Whetzel posts FAQ lists about RTs in the rt and *.answers groups. There are few to non-existent discussions on AIX/370 and AIX/ESA.
If you post questions to comp.unix.aix, please be sure to indicate: the machine type and brief configuration, e.g. Model 540, 64 MB RAM, 48 MB swap space (this is actually bad), 1.2 GB XYZ hard drive, etc. Note: There are now three classes of RS/6000s - the original, RS or POWER, RS/2 or POWER2, and PowerPC. the exact AIX version number, i.e. AIX 3.1 is NOT sufficient, whereas AIX 3.1.5 or AIX 3.1 with the 3005 update is. With 3.2 you should mention any significant ptfs using the U4xxxxx numbers. I am doing this on my own time. Please do not ask me questions that should be asked to IBM. If you suspect you have software defect problems call IBM-SERV. If you have hardware problems call IBM-SERV.



1.0 General concepts
Subject: 1.000: The AIX operating system - what is it?
This is best answered by reading the text files in /usr/lpp/bos. The README file there contains general information and the bsd file contain useful information if you know BSD and/or System V. The last release for the RT PC is 2.2.1. The latest release for PS/2s
and Intel architecture machines is AIX 1.3; for PS/2s only, 1.2.1. For the RS/6000, there are three major levels, 3.2, 4.1, 4.2, and various intermediate levels. IBM has dropped support for 3.1. For those who don’t have a copy of /usr/lpp/bos/README or bsd, I’ll sumarize: IBM tried to follow IEEE, POSIX 1003.1, ANSI C, FIPS and then X/Open Issue 3. Beyond that, AIX is a combination of System V and BSD.
------------------------------
Subject: 1.001: I know neither Unix nor AIX
- where do I find more information?
If you are new to Unix, you should look at the other newsgroups in the comp.unix hierarchy, in particular comp.unix.questions. There are FAQs more most of these groups as well. If you need information about C programming, try comp.lang.c or comp.std.c, the latter for Standard ANSI C issues. comp.lang.c has a FAQ posting.
------------------------------
Subject: 1.002: What is the Object Database?
AIX stores most of the system management information in /etc/objrepos, /usr/lib/objrepos, and /usr/share/lib/objrepos. Files (also referred to as system object classes) in these directories are adminstered by the Object Database Manager, ODM, which is a set of library routines and
programs providing basic object oriented database facilities. Under most circumstances, only SMIT or the commands SMIT call (see 1.100) should be used to change the contents of the system object classes. A harmless way to look at the object database is to use odmget where is one of the files in /etc/objrepos. Experienced users can use the ODM editor, odme, to navigate the database in detail. Modifying the database should only be attempted if you know exactly what you are doing.
------------------------------
Subject: 1.003: How do I get rid of the verbose error messages?
Many of the messages from the Unix commands are available in different languages. This is controlled by the LANG environment variable, the default being En_US meaning English in the US. All the default messages have a message number associated with them, e.g.: $ cat no-such-file cat: 0652-050 Cannot open no-such-file. If you prefer the terser Unix-looking error message, set your environment variable LC_MESSAGES to C, and you will get: $ cat no-such-file cat: Cannot open no-such-file. By default LC_MESSAGES is the same as your environment LANG. Setting LANG does also work, but should be avoided since it changes app-defaults lookup etc. See locale(): LC_ALL
------------------------------
Subject: 1.004: Which release of AIX or other products do I have?
New with 3.2.5: The oslevel command shows OS and component levels.
Run oslevel -help to see options
The command ’lslpp -h bos.obj’ will show all lines referring to the BOS, Basic Operating System. E.g.: Fix Id Release Status Action Date Time User Name
------- --------------- --------- ---------- ---------- -------- ---------
Path: /usr/lib/objrepos bos.obj
03.02.0000.0000 COMPLETE COMMIT 12/31/69 18:00:00 root
U401864 03.02.0000.0000 COMPLETE COMMIT 11/12/92 20:09:35 root
U401968 03.02.0000.0000 COMPLETE COMMIT 11/12/92 23:18:21 root
U401969 03.02.0000.0000 COMPLETE COMMIT 11/12/92 23:18:20 root
U418349 03.02.0000.0000 COMPLETE COMMIT 08/28/93 15:34:13 root
U419950 03.02.0000.0000 COMPLETE COMMIT 08/28/93 15:34:11 root
For AIX 3.2, you may come across discussions on 3.2.0, 3.2.1, 3.2.2, 3.2.3 extended, 3.2.4 and 3.2.5. There is no absolute way to tell which of these you are running since the newer releases are simply 3.2.0 with some sets of PTFs added. See above example listing. These selective fixes could mean there are literally thousands of slightly different variations of 3.2 in use. Please see section 6 to request some useful faxes to help with this number game.
AIX 3.2.4 and later attempts to resolve this confusion. The OS is broken down into subsystems so that updates can be applied to an entire subsystem. lslpp also sports a new option; use ’lslpp -m bos.obj’ to show what level and update the system is running. You can also use the new oslevel command. Unless you have a pressing need (such as applications unsupported on > 3.2.3), it is recommended that you update to this level. Also see 1.128.
------------------------------
Subject: 1.005: What hardware do I have? What is availible? WITS?
The wits script is unfortunately no longer maintained. I just don’t have the time, and I’m not sure it is a realistic proposition anymore. There are so many different models that have the same model-ID that it’s impossible to be "definitive." [Editor’s note: I’ve deleted the source to the wits program from the FAQ,but it is listed as being part of the aix.tools.1.3.0.0.exe archive at Bull’s freeware download site . Press the "Download" button once the top page loads, then look for "The Large AIX Freeware and Shareware Archive" link.]
------------------------------
Subject: 1.006: Is IBM "dropping" AIX? AIX 3 discontinued.
No. IBM sells and supports AIX 4. However, on January 31, 1997 IBM will "withraw AIX 3.2.5 from marketing." That is, you won’t be able to purchase AIX 3.2.5 anymore. On December 31, 1997, IBM will "discontinue Program Services" for AIX 3.2.5. Translation: they will no longer respond to (most) defect reports for AIX 3.2.5. The US announcement letter can be read via . Pick the US as region, look for "Announcement Letters," then search for document number 996-245. 1.1 SMIT, system administration
------------------------------


1.1 SMIT, system administration
Subject: 1.100: I am used to Unix systems programming, why should I learn SMIT?
Using SMIT is probably very different from your normal way of doing system administration, but could prove very useful in the long run. In some areas, in particular TCP/IP, NFS, etc., you can also do things the normal way, but it is unfortunately difficult to know exactly when the normal way works. Again, always using SMIT is probably your best way
to go, even when you have to learn a new tool. What SMIT actually does is build up commands with all required options to perform the functions requested and execute them. The commands called and the output they produce are stored in the files smit.script and smit.log in your home directory. Looking in smit.script may teach you more about system administration.
------------------------------
Subject: 1.101: How do I turn off the "running man" in smit?
Use smitty, the standard curses version or add this line to your .kshrc file: alias smit="smit -C"
------------------------------
Subject: 1.102: How do I import an /etc/passwd or /etc/group file from another box?
If the other box is non-AIX, copy the password and group entries for the non-system users into AIX’s /etc/passwd and /etc/group files. Then run /bin/pwdck -t ALL. This will create the proper entries in the shadow password file (/etc/security/users). You should also run usrck and grpck. To duplicate the password and group entries from another AIX box, copy /etc/passwd, /etc/group, /etc/security/passwd, /etc/security/group, /etc/security/user, /etc/security/limits, /etc/security/environ. The last three are optional unless you modified them. If you modified /etc/security/login.cfg, you should also copy that file.
------------------------------
Subject: 1.103: Cleaning up utmp, who, and accounting problems
The best way to fix this problem is to fix the programs which are causing the behavior in the first place. The short answer is to call software support and ask for the "UTMPFIX" collection of PTFs. Virtually all of these problems should be fixed in the 3251 PMP and the only one I’ve been able to prove is still broken is using ALT-F4 to close an aixterm. This applies if you are running an X11R5 xterm on 3.2. Add this to the top of X11R5 mit/clients/xterm/main.c:
#ifdef AIXV3
#define USE_SYSV_UTMP
#define HAS_UTMP_UT_HOST
#define WTMP_FILENAME "/var/adm/wtmp"
#endif
And your utmp problems should go away. If you want xterminal sessions to go into the wtmp file you need to define -DWTMP in the Imakefile and be sure the WTMP_FILENAME is set to the right place. Section 8.02 contains a small C program that you can use until the PTFs arrive. The program must be run as root and will periodically clean up old entries. Another utmp program was posted to comp.sources.unix, volume 25, issue 96 by David W. Sanderson that also works on AIX 3.1.
------------------------------
Subject: 1.104: How to fsck the root filesystem
You can run fsck either in maintenance mode or on mounted filesystems.
Try this:
1. boot from diskette (AIX 3 only --- AIX 4 boot from CD or tape)
2. select maintenance mode
3. type /etc/continue hdisk0 exit (replace hdisk0 with boot disk if
not hdisk0)
4. fsck /dev/hd4
------------------------------
Subject: 1.105: How can I unmount /usr to run fsck on it?
In order to fsck /usr, it has to be unmounted. But /usr cannot be unmounted because /bin is symbolically linked to /usr/bin. Also /etc/fsck is symbolically linked to /usr/sbin/fsck. To work around this, when you boot from the boot/maintenance diskettes and enter maintenance mode, enter "getrootfs hdisk0 sh" instead of "getrootfs hdisk0" where hdisk0 is the name of the boot disk. Then run "fsck /dev/hd2".
------------------------------
Subject: 1.108: How do I see/change parameters like number of processes per user?
You can use SMIT as described below or simply use lsattr/chdev. The former will list the current setting as in:
# lsattr -E -l sys0 -a maxuproc
maxuproc 40 Maximum # of processes allowed per user True and you can then increase the maxuproc parameter:
# chdev -l sys0 -a maxuproc=200
sys0 changed
If you just type ’lsattr -E -l sys0’ you will get a list of all parameters, some of which can be changed but not others. If you want to use smit, do as follows: smit
System Environments and Processes
Change / Show Operating System Parameters
- on this screen you can change by overtyping the following fields:
- Maximum number of PROCESSES allowed per user
- Maximum number of pages in block I/O BUFFER CACHE
- Maximum Kbytes of real memory allowed for MBUFS
- toggle fields exist for:
- Automatically REBOOT system after a crash (false/true)
- Continuously maintain DISK I/O history (true/false)
Info 1.30 erroneously suggests that in AIX 3.2.5 you can set different limits for different users.
------------------------------
Subject: 1.109: How do I shrink the default paging space on hd6?
1) create a paging space to use temporarily
mkps -s 20 -a rootvg
2) change default paging space hd6 so it is not used at next reboot
chps -a n hd6
3) For AIX 3.1, edit /etc/rc.boot4 and change swapon /dev/hd6; for AIX 3.2 and 4.x, edit /sbin/rc.boot and change swapon /dev/hd6 swapon /dev/paging00
3a)Since the default system dump device is /dev/hd6 in 4.1.x, it has to be changed to the temporary swap device before you remove the old swap device.
sysdumpdev -p /dev/paging00
4) Update information in boot logical volume
bosboot -a (3.1)
bosboot -a -d hdisk0 (3.2 & 4)
5) shutdown and reboot
6) remove current hd6 and create a new one of smaller size
rmps hd6
mklv -y hd6 -t paging rootvg
7) Re-edit /etc/rc.boot4 (3.1), /sbin/rc.boot (3.2) to swap to /dev/hd6
swapon /dev/hd6
7a)On AIX 4, change the dump device back to hd6:
sysdumpdev -p /dev/hd6
8) Update information in boot logical volume
bosboot -a (3.1)
bosboot -a -d hdisk0 (3.2 & 4.1)
9) change current paging device (paging00) so it is inactive at next boot
chps -a n /dev/paging00
10) shutdown, reboot, remove paging00 using the command:
rmps paging00
You can check your paging space with ‘lsps -a‘
------------------------------
Subject: 1.110: The swapper seems to use enormous amounts of paging space, why?
When you run ps, you may see a line like:
USER PID %CPU %MEM SZ RSS TT STAT TIME CMD
root 0 0.0% 14% 386528 8688 - S 17:06 swapper
This is normal behavior, the swapper looks to ps like it has the entire paging space plus real memory allocated.
------------------------------
Subject: 1.111: How much paging space do I need?
See answer 2 in question 1.300.
------------------------------
Subject: 1.112: How do I mount a floppy disk as a filesystem?
You can build a filesystem on a floppy and mount it, however the filesystem will be read only. The reason that the filesystem will be read only is because AIX Version 3.1.5 cannot create a journal log on a diskette. The intended use is for temporary access to read only data. The diskette file system must be unmounted after use and during system backup procedures or errors could occur. To make the read only filesystem on a floppy:
1. Make a subdirectory on an existing filesystem and place all of the files that the diskette will contain into this subdirectory.
2. Enter the following command to create a prototype file containing information about the new filesystem, in the example /dir_struct is the pathname of the subdirectory created in step 1, and proto_filename is the name of the prototype file to be created. proto /dir_struct > proto_filename
3. Place a formatted floppy into the drive.
4. Edit the prototype file and replace the first line with the following: 0 0
5. Enter the following command to make the filesystem on your floppy:
mkfs -p proto_filename -V jfs /dev/fd0
6. Create the directory upon which you will mount the floppy based filesystem, or you can use /mnt. Mount the filesystem:
mount -r -V jfs /dev/fd0 /your_mount_point
7. To unmount the filesystem:
umount /dev/fd0
Since the filesystem is read-only it may be of limited use but if you are going to use it for utility programs and other data that does not change much, it may still be useful. If you need to change the data, you can copy the directory from the floppy into another directory, make your modifications, and remake the filesystem using this procedure.
------------------------------
Subject: 1.113: How do I remove a committed lpp?
AIX 3.2.5: you can get rid of COMMITTED lpps/ptfs by installing with the force option and then rejecting the package.
AIX 4.1 users: installp has a new option, uninstall (-u) which can be
used to remove lpps.
------------------------------
Subject: 1.114: How can I recover space after installing updates?
Note: If you are a /usr server, do not use this because the files mentioned below are needed by /usr clients and cannot be deleted. Installp creates numerous files in /usr to clean up after failed/rejected installs and also for de-installing uncommitted lpps. Once you have COMMITted packages you can remove these files safely. Depending on your installation activity the numbers can be significant: hundreds-to-thousands of files, megabytes of data. Files eligible for removal are associated with each "product" you have installed; the largest collection being due to bos. After COMMITting bos lpps, you may safely remove all files of the form:
/usr/lpp/bos/deinstl*
/usr/lpp/bos/inst_U4*
/usr/lpp/bosadt/deinstl*
and /usr/lpp/bosadt/inst_U4*
You may repeat this for all additional COMMITted products (e.g., bostext1, bosnet, xlc) you have on your system. This problem of lingering install files is a known defect in installp. If you have installed PTF U411711 (or any superseder of it: U412397, U413366, U413425) the deadwood in /usr will not be quite as prevalent. No single PTF currently available completely corrects this problem. On my own 320, the following freed up 12.4M in /usr:
# rm -R /usr/lpp/bos/deinstl*
# rm -R /usr/lpp/bos/inst_U4*
------------------------------
Subject: 1.115: Where are the AIX log files kept?
AIX logs messages as specified in /etc/syslog.conf. Here’s an example
*.err;kern.debug;auth.notice;user.none /dev/console
*.err;kern.debug;daemon,auth.notice;mail.crit;user.none /var/adm/messages
lpr.debug /var/adm/lpd-errs
*.alert;kern.err;daemon.err;user.none operator
*.alert;user.none root
*.emerg;user.none *
for loghost machines, to have authentication messages (su, login, etc.) logged to a file, un-comment out the following line and adjust the file name as appropriate. if a non-loghost machine chooses to have such messages sent to the loghost machine, un-comment out the following line.
auth.notice /var/log/authlog
mail.debug /var/log/syslog
following line for compatibility with old sendmails. they will send messages with no facility code, which will be turned into "user" messages by the local syslog daemon. only the "loghost" machine needs the following line, to cause these old sendmail log messages to be logged in the mail syslog file.
user.alert /var/log/syslog
non-loghost machines will use the following lines to cause "user" log messages to be logged locally.
user.err /dev/console
user.err /var/adm/messages
user.alert ‘root, operator’
user.emerg *
------------------------------
Subject: 1.116: How can I log information about ftp accesses to a file?
1) In /etc/syslog.conf, add the line: daemon.debug /tmp/daemon.log
2) # touch /tmp/daemon.log
# refresh -s syslogd
3) Modify your inetd.conf so that ftpd is called with the "-l" flag. You may also want the "-d" flag. This can be done with ’smit inetdconf’. All the syslog messages from various system daemons should now appear in the file "/tmp/daemon.log".
------------------------------
Subject: 1.117: How do I find a file name from the inode number?
ncheck -i nnnn /mntpoint
------------------------------
Subject: 1.118: How do I set up postscript accounting?
Ephraim Vider originally wrote this program to configure postscript page accounting. It acts as a backend wrapper which logs accounting information in /etc/qconfig and can be ftp’d from utpapa.ph.utexas.edu in /pub/aix/psacct.tar.Z.
Compile with:
cc pswrap.c -o pswrap -lqb
and then make this program suid root:
chown root pswrap
chmod u+s pswrap
If this step is not done, the printer will hang.
Then start up SMIT and go to :
Spooler
Manage Local Printer Subsystem
Local Printer Queue Devices
Change / Show Characteristics of a Queue Device


and change "BACKEND PROGRAM pathname" to the full pathname of pswrap since pswrap will now handle the backend interface with the queue. A stream of info will be written to a logfile in /tmp (prob lp0.log) but this file is mainly used for status info and raw pagecounts. If the accounting data is going to the qconfig-specified acctfile, then use the ’pac’ command to read it. I prefer to have readable ascii data files instead, so I just comment out the ’#define WANT_PAC’ line and it will only go to the ACCTFILE specfied in pswrap.c.
[pswrap.c source has been moved to section 8.03]
------------------------------
Subject: 1.119: How do I create boot diskettes?
In AIX 4.1.x and 4.2 you cannot, the kernel and ram drive don’t fit on a diskette. You should get "0301-174 bosboot: Invalid device /dev/fd0 specified!" if you try.
For AIX 3.2.x you will need to have four formatted diskettes. boot disk: bosboot -d /dev/fd0 –a
display disk: mkdispdskt
display extension disk: mkextdskt
Install/Maintenance disk: mkinstdskt
AIX 3.2.5 may require a fifth boot diskette if you have a FDDI adapter in the machine. It is the "communications extension" diskette.
------------------------------
Subject: 1.121: How can I tell what virtual printer a print queue is using?
Use the command ’lsvirprt’. Don’t use any parameters and it will run in an interactive mode that will give you a menu of all virtual printers on the system with the queue and device for each one.
------------------------------
Subject: 1.122: Two srcmstr’s are less useful than one?
This can happen on systems that have no console, or systems with an async terminal as the console but not attached or turned off. One of the symptoms is a second srcmstr got run. But the second srcmstr is worthless as we can’t use the stop/startsrc commands, refresh inetd, qdaemon won’t start, etc. To resolve this, type: smit chgtty and add the keyword ’clocal’ in following lines:
STTY attributes for RUN TIME
STTY attributes for LOGIN
------------------------------
Subject: 1.123: How do I set the tty name associated with a physical port?
Let’s say you wanted to make a tty on the s1 port and call it rs0000 and a tty on the s2 port and call it rs0001.
You could run:
mkdev -c tty -s rs232 -t tty -l rs0000 -p sa0 -w s1 # creates rs0000 and
mkdev -c tty -s rs232 -t tty -l rs0001 -p sa1 -w s2 # creates rs0001
------------------------------
Subject: 1.124: How do I use mksysb to clone a system?
I use the following steps on the master machine to clone an AIX system:
1) Remove the password from root.
2) Remove the NIS line from the end of the /etc/group file (the last line with the +: )
3) Change most of the level ’2’ designations in /etc/inittab to level ’3’ to prevent them from being started up when the new system is booted (the minimum ones to change are rc.nfs and rc.tcpip)
4) Boot in service mode and change the name and ip address to a "spare" set to avoid address collision.
5) Clear /tmp, /usr/tmp and /usr/spool/lpd/stat.
6) Run mkszfile and edit it to be sure /usr is as small as possible; then mksysb from the command line.
The above changes allow me to boot in normal mode the first time, get in as root, change the above files back and do the other things necessary to configure the new system. Then, of course, I go back and clean up and reboot my master machine.
Note: 1 and 2 lets you log in even if you can’t get on the network. It prevents the login process from trying to reach an NIS server. Step 2 needed only if you use NIS.
------------------------------
Subject: 1.125: How do I retain timestamps with mksysb?
As of AIX 3.2.5 bosrest preserves timestamps and permissions as does pax.
In AIX 3.2.2 /usr/lpp/bosinst/bosnet (for net installs), and bosrest (tape), the ’pax’ commands all have ’-pmop’ options. m = "DON’T retain modification times". So, simply change all the ’-pmop’ to’-pop’ and remake inst/maint diskettes or mksysb tapes.
------------------------------
Subject: 1.127: Updating to 3.2.5
(Ed. The following is useful if you have to update a large number of
systems, large being > 3.)
*** WARNING : Modify the scripts if you need dataless, diskless ***
*** or remote /usr support. ***
1) Receive the PMP3250 tape from your AIX support center the PTF number is U493250.
2) Create a filesystem with 240 MB of space (60 PP’s) and mount it as /dev/pmp3250 - /pub/pmp3250
3) Insert the tape (blocksize is 512) and install PTF U422467
# installp -BXacgq -d /dev/rmt0 bos.obj 3.2.0.0.U422467
4) Use the following script to load the tape in the new filesystem
# cd /pub/pmp3250
# mktape2disk.sh 0 447 <<-- read 447 files from rmt0
------------------------------
Subject: 1.129: Are passwords limited to 8 char?
AIX passwords are only significant to 8 characters. You can set a
passwd to more than 8 characters but anything over eight are ignored.
No messages or warnings are given.
Be careful if you’re running NIS. You probably want to limit passwords
to 8 char on all machines (6000 and others) to be compatible.
Someone mentioned that DCE supports kerberos which supports passwords
greater than 8 characters.
------------------------------
Subject: 1.130: How do I increase the number of ptys > 64?
SMIT only allows 64. Try this:
odmget -q"attribute=num and uniquetype=pty/pty/pty" PdAt | sed "s/0-64/0-512/" |
odmchange -q"attribute=num and uniquetype=pty/pty/pty" -o PdAt
chdev -l pty0 -anum=256 -P
reboot
------------------------------
Subject: 1.131: Where can I find patches for CERT advisories?
Patches (APARs in IBMspeak) for CERT advisories (system security problems) can be found at . You should have a copy of Fixdist
handy to deal with translating APAR and PTF numbers into downloadable files.
See question 1.142 for more information about fixdist.
------------------------------
Subject: 1.132: How do I remove a non-existant physical volume?
To delete a phantom disk from the ODM use reducevg with the pvid instead of the disk name. You are running some command such as lsvg or varyonvg and it is griping about a disk that is no longer findable right? In that warning message, it should give you a pvid. Try one
of the following, (note: reducevg updates the VGDA but not the ODM).
reducevg -f
ldeletepv -g VGid -p Pvid -g Required, specify the VGid of the volume group you are removing the physical volume from-p Required, specify the PVid of the PV to be removed
------------------------------
Subject: 1.133 How do I kill a process that ignores
kill -QUIT -KILL -STOP
If there is i/o pending in a device driver, and the driver does not catch the signal, you can’t kill it - a reboot is the only way to clear it.
Furthermore, if the process stays hung for more than a few minutes, you can find out what device is wedged by doing this --
% echo trace -k $(expr / 256) | crash | tee stack
If you can’t figure out what is wrong, print that trace out and call
1-800-xxxx and tell them that something is broken. Tell them you want to fax in the nice stack trace that you have as your testcase.
------------------------------
Subject: 1.134: How can I see "console" messages?
Use the swcons command to redirect the console to a file. Or use chcons to do it permanently.
------------------------------
Subject: 1.135: Where can I find TOP for AIX?
TOP functionality is included in an AIX package called Monitor. See question 1.120 for more information.
------------------------------
Subject: 1.136: How can I restrict root logins to specific terminals?
Read FAX 2737 availible from the 800-IBM-4FAX number discussed in section 6.02. Refer to APAR IX45701 for fixes related to the rsh style commands.
------------------------------
Subject: 1.137: How do I merge my /etc/password and /etc/security/password for Crack?
/usr/sbin/mrgpwd. You must have permissions to read /etc/security/password.
------------------------------
1.138: I lost the root password, what should I do?
Boot from boot diskettes, bootable tape, or bootable CD.
At the Installation/Maint menu select item 4, "Start a limited function maintenance shell.
At the subsequent "#" prompt enter the command:
getrootfs hdiskN
(where "N" is replaced by the number of a disk on your system that is in rootvg.)
That will run for about a minute or so and you get a # prompt back. At this point you are logged in as root in single user mode. Change to /etc/security and edit the passwd file. Delete the three lines
under root: password, update time (or whatever it’s called), and flags. Save the file.
Then at the prompt, give root a new password.
Shutdown/reboot in normal mode. Log in with new password.
------------------------------
Subject: 1.139: How can I resolve DEV_WAIT status for a local print queue?
Try "qadm -k && qadm -U"
------------------------------
Subject: 1.140: SMIT problems forcing/overwriting install?
Installp does not support overwriting and installing prerequisite software at the same time.
------------------------------
Subject: 1.143: Is there an easy way to determine if AIX
has a PTF applied or not?
lslpp -Bl Uxxxxxxx
Where Uxxxxxxx is the PTF id.
------------------------------
Subject: 1.144: How do I recreate a deleted /dev/null?
/bin/mknod /dev/null c 2 2
------------------------------
Subject: 1.145: What is a checkstop error?
While this may not be the official definition, what it means is that the hardware has detected a condition that it cannot resolve, and which prevents normal operation. So, it stops executing instructions, responding to interrupts, etc. Usually it means that some component of the hardware is broken.
------------------------------
Subject: 1.146: How do I recover deleted files?
Preferably from a backup. If you don’t have a backup, at least one company, Compunix, claims to have a product that will recover deleted files. [Editor’s note: this one appears to be for the really desperate ones, but it might be helpful if you really need it the most.] RECOVERING REMOVED FILES AND DIRECTORIES IN A FILESYSTEM If a file is Deleted from the system, the filesytem blocks composing that file still exist, but are no longer allocated. As long as no new files are created or existing files extended within the same filesystem, the blocks will remain untouched. It is possible to reallocate the blocks to the previous file using the "fsdb" command (filesystem debugger).
MAKE A BACKUP OF THE ENTIRE FILESYSTEM BEFORE PERFORMING THESE STEPS!!! ELSE ( BANG !!!!! ).

Steps to recover a deleted file
-------------------------------
1) "ls -id {dir}"
(where dir is directory where file resided) Record INODE number for next step.
2) Unmount the filesystem.
3) "fsdb /{Mountpoint}" or "fsdb /dev/{LVname}"
(where Mountpoint is the filesystem mount point, and LVname is the logical volume name of the filesystem)
4) "{INODE}i"
(where INODE is the inode number recorded in step 1) This will display the inode information for the directory. The field a0 contains the block number of the directory.
The following steps assume only field a0 is used. If a value appears in a1, etc, it may be necessary to repeat steps #5 and #6 for each block until the file to be recovered is found.
5) "a0b" (moves to block pointed to by field "a0" of this inode)
6) "p128c" (prints 128 bytes of directory in character format) Look for missing filename. If not seen, repeat this step until filename is found. Record address where filename begins. Also record address where PRIOR filename begins. If filename does not appear, return to step #5, and selecting a1b, a2b, etc.
Note that the address of the first field is shown to the far left. Increment the address by one for each position to the right, counting in octal.
7) "a0b" (moves to block pointed to by field "a0" of this inode) If the filename was found in block 1, use a1b instead, etc.
8) "p128e" (prints first 128 bytes in decimal word format) Find the address of the file to recover (as recorded in step 6) in the far left column. If address is not shown, repeat until found.
9) Record the address of the file which appeared immediately PRIOR to the file you want to recover.
10) Find the ADDRESS of the record LENGTH field for the file in step #9 assuming the following format:
{ADDRESS}: x x x x x x x x x x ...
| | | | |-------- filename ------|
inode # --+----+ | |
| +-- filename length
record LENGTH --+
Note that the inode number may begin at any position on the line.
Note also that each number represents two bytes, so the address of the LENGTH field will be ‘{ADDRESS} + (#hops * 2) + 1’
11) Starting with the first word of the inode number, count in OCTAL until you reach the inode number of the file to be restored, assuming each word is 2 bytes.
12) "0{ADDRESS}B={BYTES}"
(where ADDRESS is the address of the record LENGTH field found in step #10, and BYTES is the number of bytes [octal] counted in step #11)
13) If the value found in the LENGTH field in step #10 is greater than 255, also type the following: "0{ADDRESS-1}B=0"
(where ADDRESS-1 is one less than the ADDRESS recorded in step #10) This is necessary to clear out the first byte of the word.
14) "q" (quit fsdb)
15) "fsck {Mountpoint}" or "fsck /dev/{LVname}"
This command will return errors for each recovered file asking if you wish to REMOVE the file. Answer "n" to all questions. For each file that is listed, record the associated INODE number.
16) "fsdb /{Mountpoint}" or "fsdb /dev/{LVname}"
17) {BLOCK}i.ln=1
(where BLOCK is the block number recoded in step #15) This will change the link count for the inode associated with the recovered file. Repeat this step for each file listed in step #15.
18) "q" (quit fsdb)
19) "fsck {Mountpoint}" or "fsck /dev/{LVname}". The REMOVE prompts should no longer appear. Answer "y" to all questions pertaining to fixing the block map, inode map, and/or superblock.
20) If the desired directory or file returns, send money to the author of this document.
------------------------------
Subject: 1.148: How can I run a command or commands at system shutdown?
"Stock" AIX 4.1.x doesn’t have any obvious place to add commands to the shutdown sequence. You can 1) modify /etc/shutdown (it’s a shell script); 2) add your commands to /etc/netware.clean (shutdown invokes this program if it exists) or 3) install APAR IX65326 ("ADD /ETC/RC.SHUTDOWN TO SHUTDOWN SCRIPT IN AIX4.1.5) which adds a user-defined /etc/rc.shutdown script to the shutdown sequence. AIX 4.2 already has a similar feature.
------------------------------
Subject: 1.150 How can I reduce the size of /var/adm/wtmp ?
The file /var/adm/wtmp grows with each login, but is never reduced. The contents of wtmp is used (only?) by the command "last", which shows, in reverse order, all the logins and reboots that happened since the start of the wtmp file. The file should not be deleted, but the contents can be discarded using the following command:
# > /var/adm/wtmp
------------------------------
Subject: 1.151: How do I start local daemons at system startup?
AIX does neither use the BSD style rc.local file nor the System V style /etc/rc*.d startup files directories. To add local daemons to the system startup sequence in a BSD rc.local style use the following command to create an /etc/inittab entry:
# mkitab -i rcnfs "rclocal:2:wait:/etc/rc.local >/dev/console 2>&1"
# touch /etc/rc.local
# chmod 700 /etc/rc.local
Then put the command lines to start the daemons in /etc/rc.local.
------------------------------
Subject: 1.152 How do I set the TZ variable to automatically change to daylight savings time?
The TZ variable can be set in /etc/environment file so the time automatically switches to daylight savings time in spring and back to normal in autumn. The actual rules when to switch vary by country, the following should work in middle europe: TZ=MET-1MET DST,M3.5.0/02:00:00,M10.5.0/03:00:00
The exact definition for the rules can be found with infoexplorer under the environment page.
------------------------------
Subject: 1.153 Why does init not reap its zombie child processes?
If you have lots of zombie (defunct) processes with parent process id 1, the init process is probably waiting for some bad /etc/inittab configuration line to finish. Check the inittab file for entries that specify the wait keyword for processes that do not terminate. These lines should probably specify "once" or "respawn" instead.
------------------------------
Subject: 1.154 I’m looking for a missing command or header file.
Which fileset do I need to install?
If you are at AIX Version 4.2.1 or later you could install bos.content_list and then use the command "which_fileset [ File ]" The which_fileset command searches the /usr/lpp/bos/AIX_file_list file for a specified file name or command name, and prints out the name of the fileset that the file or command is shipped in.
------------------------------
Subject: 1.155 Why doesn’t the df -k output reflect the space I added to an LV?
You need to use the chfs command or the smit chfs menu to tell the file system to use the new space. By the way, in most cases it is better to just increase the size of the file system, it will increase the underlying LV automatically.



1.2 Backups, tape
Subject: 1.201: How do I do remote backup?
There seems to be several ways of doing this. The first approach is a one-liner to allow tar to reference another machine’s device. The second is more complete but uses a similar approach. The latest addition to this section claims to be able to support mksysb on a remote machine. Thanks to all the contibutors.
tar -b1 -cf - . | rsh REMOTEHOST "dd ibs=512 obs=1024 of=/dev/TAPEDEVICE"
[Ed.: The usave.sh script has been moved to section 8.06. I’ve verified this script works fine. However, it may be slow for large filesystems since it creates a temp file of filenames in /tmp.]. There are also several commercial solutions. One is IBM’s SYSBACK/6000 product. See Question 1.209 for more information. Open Microsystems sells a product called DistribuTAPE which supports mksysb to a remote tape drive under AIX 3.2, 4.1 and 4.2. DistribuTAPE supports remote tape drives by placing a pseudo tape driver on the client system, and a server daemon on the server.
------------------------------
Subject: 1.204: How can I make an exact duplicate of a tape over the network?
The challenge here is not to have to create a temporary file (disk space limitation) and work across heterogeneous networks. This script might work:
LOCAL=/dev/tape_dev
REMOTE=/dev/tape_dev
dd if=$LOCAL ibs=64k obs=512 | rsh remote_host dd ibs=512 obs=64k of=$REMOTE
#!/bin/perl
# Wrapper to convert input rmt requests to
# AIX 3.2 ioctl numbers. We pass on all commands we don’t understand
# I0 MTWEOF -> I10 STWEOF write and end-of-file record
# I1 MTFSF -> I11 STFSF forward space file
# I2 MTBSF -> I12 STRSF reverse space file
# I3 MTFSR -> I13 STFSR forward space record
# I4 MTBSR -> I14 STRSR reverse space record
# I5 MTREW -> I6 STREW rewind
# I6 MTOFFL -> I5 STOFFL rewind and unload tape
# I7 MTNOP -> I0 (no-op? should ignore following count)
# I8 MTRETEN-> I8 STRETEN retension tape, leave at load point
# I9 MTERASE-> I7 STERASE erase tape, leave at load point
#I10 MTEOM (position to end of media ... no ibm equivalent?)
#I11 MTNBSF (backward space file to BOF ... no ibm equivalent?)
@iocs = (10,11,12,13,14,6,5,0,8,7);
open(RMT,"|/usr/sbin/rmt") || die "Can’t open pipe to rmt\n";
select(RMT);
$| = 1;
while () {
s/(^I)(\d$)/I$iocs[$2]/;
exit 0 if $_ =~ /^[Qq]/;
print RMT $_ ; }
exit 0;
------------------------------
Subject: 1.205: What is tape block size of 0?
Tape devices are generally split into two categories: fixed block and variable block. 1/4" tape is the fixed block, and 8mm is variable. On a fixed block size device, the kernel always sends data to the device in suitable block size lumps, and varying the size passed to write(2) (e.g., via the bs option to dd) gives the kernel more data to stream. On a variable block size device, the kernel writes to the device whatever passed to it. On an 8mm, it had better be a multiple of 1024 to get efficient tape usage. AIX has the World’s Only Variable Block Size 1/4" tape drive. If you use SMIT to set the block size to a nonzero value, AIX treats the device as fixed block size, whether it is or not. By default, 8mm drives are set to the same size as 1/4", 512 bytes. This is wasteful, but otherwise mksysb and installp would fail. If you set the block size to 0, the device is treated as variable block size, and the size passed to write becomes the physical block size. Then if you use a sensible block size to dd, all should be wonderful.
------------------------------
Subject: 1.206: Resetting a hung tape drive
A process accesses the tape drive. The process stops, exits, or whatever, but still hold on to the drive. When this happens, the process cannot be killed by any signal and the tape drive cannot be used by any other process until the machine is rebooted. The following should help: RESET:
AIX, like most UNIX systems has no reset function for tape drives. You can however send a Bus Device Reset (a standard SCSI message) to the tape drive using the following piece of code. If the tape drive does not respond to the BDR, then a SCSI Bus Reset will be sent (and this will reset every device on the SCSI Bus). SCSI Bus resets are rather extreme so you should refrain from using this program unnecessarily. But there are times (like after you’ve inserted a jammed/old/bad tape in an 8mm drive), when there’s no other way to reset the device other than to shutdown and reboot (obviously you can power down and up an external drive to reset it - and this would be the better choice). This is actually documented in info, but can be hard to find and there’s no complete program.
/* taperst: resets the tape drive by sending a BDR to the drive. */
#include
#include
#include
#include
int main(int argc, char **argv)
{
/* This can be run only by root */
if (argc != 2) {
fprintf(stderr, "Usage: %s /dev/rmt#\n", argv[0]);
return 1;
}
if (openx(argv[1], O_RDONLY, 0, SC_FORCED_OPEN) < 0) {
perror(argv[0]);
return 2;
}
return 0;
}
------------------------------
Subject: 1.207: How do I restore specific files from a mksysb tape?
To recover specific files from a backup made with mksysb, try
$ tctl fsf 3
$ tar xvf /dev/rmt0.1 ./your/file/name
From: Matt Willman
The procedure changed with AIX 4, which uses backup instead of tar to write the tape. For AIX 4 the procedure is as follows:
$ tctl fsf 3
$ restore -xvf /dev/rmt0.1 ./your/file/name
------------------------------
Subject: 1.209: What can Sysback do for me?
Sysback provides the flexibility of restoring onto the same system in the exact same manner, or onto a completely different system with differnet disk configuration, platform type, kernel, etc, while reporting any inconsistencies and allowing you to adjust to fit. For instance, you will get warnings if a particular volume group cannot be created because the original disks to not exist, or that mirroring cannot be accomplished because there is no longer enough disk space because the disks are smaller. You can then select the disks for each volume group, reduce or add space to filesystems and LVs, exclude entire VGs or filesystems, etc. You can even add and delete mirrors, stripe or un-stripe logical volumes, etc. In addition, all of the Sysback functions can be performed across the network, including network boot and network install, and you can perform striped backups across multipel tape drives, use sequential tape autoloaders, and perform unattended multi-volume backups with cron.
ON AIX 3.2, mksysb does not retain paging space config, disk LV placement, mirroring, etc.
On AIX 4.1, it does these on an EXACT same configuration, but does not allow any flexibility, and still does not retain non-rootvg volume groups (although you can now use additional commands to backupand restore these). mksysb also does not allow you to clone onto different platforms (i.e. rspc -> rs6k -> rs6ksmp).
------------------------------
Subject: 1.210: How can I get my HP 4mm DAT to work?
For HP25470/80A DDS:
MRS disabled: Set switches 3,6,7,8=0 and 1,2,4,5=1
MRS enabled: Set switches 3,6,7=0 and 1,2,4,5,8=1
------------------------------
Subject: 1.211: How do I copy DAT tapes?
If you have two drives try tcopy(1). Otherwise the traditional UNIX approach is ( dd if=/dev/rmt0 bs=1024b | dd of=/dev/rmt1 bs=1024b ) Put that in a while loop using a non-rewinding device to do multiple files. To use drives from two different machines either get the GNU dd (bundled with GNU tar) or use something like.
$ dd if=/dev/rmt0 bs=1024b | rsh hostname dd of=/dev/rmt0 bs=1024b
------------------------------
Subject: 1.212: How do I speed up backups to DLT tapes?
DLT tapes need high data rates to stay in streaming mode. To achieve
higher data rates, use a variable length block size by setting the fixed
length block size to zero. Also use a buffer size of about 64KB for
backup (128 blocks for tar).



1.3 Memory and process management
Subject: 1.303: What is kproc?
kproc (always PID 514 on AIX 3 and PID 516 on AIX 4) is the kernel’s idle process.
------------------------------
Subject: 1.304: How do I create a RAM disk in AIX?
You can’t create a RAM disk in AIX. The closest related functionality the operating system gives you is the RAM disk buffer.
------------------------------
Subject: 1.305: How much RAM (real memory) does my machine have?
As root: bootinfo -r
As any user: lsattr -E -l sys0 -a realmem
lsdev -C -c memory
shows all memory adapters. On MCA systems one may add up the values displayed for each memory card in order to sum up to the amount of total memory. On PCI systems only one item (mem0) is displayed. Additional information may be displayed with lsattr -E -lmem0
These commands were tested on various IBM systems running AIX relases 3.2.5 and 4.1.4
------------------------------
Subject: 1.306: Why do PIDs run non-sequentially?
The answer (I was there, consider me an authority ...) is that the PIDs needed to be somewhat unpredictable. This is because AIX was originally designed with a number of C2 and B1 features, and one of those is the notion of covert channel analysis. Sequential PIDs are a covert channel (assuming the system has one PID namespace ...) since the value of the "next" PID is shared by all currently running processes. So if I want to sneak some of my classified data out to your co-operating non-classified program, I can do it by carefully controlling the value of the "next" PID.



1.4 Shells, commands, man pages, InfoExplorer
Subject: 1.400: How do I make an informative prompt in the shell?
In the Korn Shell (ksh), the PS1 variable is expanded each time it is printed, so you can use:
$ export myhost=‘hostname‘
$ PS1=’$LOGNAME@$myhost $PWD \$ ’
to get, e.g.
bengsig@ieibm1 /u/bengsig $
In the C-shell, use:
% set myhost=‘hostname‘
% alias cd ’chdir \!* > /dev/null; set prompt="$LOGNAME@$myhost $cwd % "’
% cd
to get, e.g.
bengsig@dkunix9 /u/bengsig/aixfaq %
There is no easy solution in the Bourne Shell. Use the Korn Shell instead.
------------------------------
Subject: 1.401: How do I set up ksh for emacs mode command line editing?
The ksh has an undocumented way of binding the arrowkeys to the emacs line editing commands. In your .kshrc, add:
alias __A=‘echo "\020"‘ # up arrow = ^p = back a command
alias __B=‘echo "\016"‘ # down arrow = ^n = down a command
alias __C=‘echo "\006"‘ # right arrow = ^f = forward a character
alias __D=‘echo "\002"‘ # left arrow = ^b = back a character
alias __H=‘echo "\001"‘ # home = ^a = start of line
Type "set -o emacs" or put this line in your .profile.
Also, you MUST have PTF U406855 for this to work in AIX 3.2. The APAR # for the problem is IX25982, which may have been superseded.
------------------------------
Subject: 1.402: Listing files with ls causes a core dump
Scenario: a directory that is shared by N users (N >= 200).
Run ’ls -l’ in that directory. It goes for a while, then Seg fault(coredump)!
It only occurs when the usernames are displayed (almost every file is owned by a different person). The -g and -n options work fine; only –l and -o (which shows owner and not group) cause it. I believe that this problem was corrected by U407548. If you have that many users that you are having core dump problems (it took over 200), you might also want to look into getting the PTF that fixes IX31403. That APAR deals with large numbers of accounts and performance problems associated with looking them up.
------------------------------
Subject: 1.403: How do I put my own text into InfoExplorer?
With AIX 3.1, you cannot do it. AIX 3.2 has a product called InfoCrafter that allows you to do that.
------------------------------
Subject: 1.404: InfoExplorer ASCII key bindings
If you just press ’Return’ when it starts up, with ’Basic Screen Operations’ highlighted, you’ll get some help. If you look long enough, you’ll find a page named ’Using Keys and Key Sequences in the InfoExplorer ASCII Interface’. It describes the key sequences and actions. Here are a few to get you started.
Keys Action
Ctrl-W Moves between the Navigation screen and the Reading screen. If the Navigation screen is displayed, you can press Ctrl-W to display the Reading screen. If the Reading screen is displayed, you can press
Ctrl-W to display the Navigation screen.
Ctrl-O Makes the menu bar active or inactive. If your text cursor is located in the text area of the screen, you can press Ctrl-O to make the menu bar active. If the menu bar is already active, you can press
Ctrl-O to make it inactive, which moves the text cursor to the text area.
Tab Moves to the next menu bar option in the menu bar. If a pull-down menu is not displayed and you press the Right Arrow key, the next menu bar option is displayed in reverse video.
------------------------------
Subject: 1.405: How can I add new man pages to the system?
Put the man pages in /usr/man, e.g. /usr/man/man1/tcsh.1 for the tcsh man page. Under AIX 3.1.10, /usr/lib/makewhatis can be used to update the makewhatis-database /usr/man/whatis so apropos and whatis know about the added manpages. /usr/lib/makewhatis should be available on all 3.2 versions.
For AIX 4.x, you can store the man pages in the /usr/share/man hierarchy. /usr/lib/makewhatis is still there.
------------------------------
Subject: 1.406: Why can’t I read man pages? Where is nroff?
Nroff and troff aren’t in the base installation. It is shipped as part of AIX 3.2.5 but may not be installed. Use smit to install a software package called txtfmt.tfs.obj from your 3.2.5 distribution media.
In AIX 4.x, you need bos.txt.tfs.
------------------------------
Subject: 1.407: Why is my environment only loaded once?
The .profile file is only loaded once (for your login shell) subsequent shells should be initialized by setting ENV=$HOME/.kshrc (for ksh). Bash users can use $HOME/.bash_profile for the login shell environment and $HOME/.bashrc.
------------------------------
Subject: 1.408: Where is the ’nawk’ command on my AIX system?
The /bin/nawk that exists on many UNIX flavors is a superset of the ’awk’ command, revised by the same original authors to include added functionality. All the extra options normally associated with ’nawk’ on other UNIXes have been incorporated into the AIX version of ’awk’; the AIX ’awk’ InfoExplorer or man pages include nawk-specific features such as the "-v" command line option and atan2(), rand(), srand(), match(), sub(), gsub(), system(), close(), getline functions. If your AIX version is missing /bin/nawk (as are most AIX 3.x
versions), the simplest way to get around this and maintain script portability between UNIX platforms is to make a /bin/nawk link to /bin/awk (as root, of course). If you do not have root privilege or do not want to create a /bin/nawk link, to make the script work on different UNIXes, you may have to test ‘uname‘ first and set all ’nawk’ references on AIX runs to /bin/awk. If your script is to only run on AIX systems, you can just change all references of ’nawk’ to ’awk’ and everything should still work okay...but check the AIX awk script on test data prior to making actual runs.
[Editor’s note: AIX 4.x already contains a link from /usr/bin/nawk to /usr/bin/awk.]
------------------------------
Subject: 1.410: Why can’t I set my default shell to one we’ve just installed?
When adding new shells to the system, add them to the "shells=" line in /etc/security/login.cfg so they can be used during ftp and rlogin by users who use them as their default shell.
------------------------------
Subject: 1.411: Why do I get the "Unable to connect socket: 3" starting Info-Explorer?
It’s a bug in the way infod sets the initial permission on the /tmp/.info-help socket. Do a chmod 777 on /tmp/.info-help and the message will go away.
This problem was fixed by APAR IX43230, PTF U432315

1.6 Networks and communications
Subject: 1.601: How do I trace ethernet packets on an AIX system?
Do the following:
iptrace -i en0 /tmp/ipt
The iptrace backgrounds. Find its process id and kill it when you are ready. Then run
ipreport -rns /tmp/ipt >/tmp/ipr
and look at the output. The current version of Info does not document the r, n and s options but they are quite useful for layering the output.
------------------------------
Subject: 1.602 What is the authorized way of starting automount at boot time?
I put this in my /etc/inittab:
automount:2:once:/usr/etc/automount -T -T -T -v >/tmp/au.se 2>&1
I hereby dub it authorized.
Jim Salter writes: You can also use the command:
’mkitab "automount:2:once:/usr/etc/..."’ to avoid editing the file by hand.
------------------------------
Subject: 1.603: How do I set a tty port for both dial-in and dial-out?
Set the mode of the tty to be either ’shared’ or ’delayed’.
------------------------------
Subject: 1.604: How to move or copy whole directory trees across a network
The following command will move an entire directory tree across a network while preserving permissions, uids and gids.
$rsh RemoteHost "cd TargetDir; tar -cBf - ." | tar -xvBf -
Explanation:
The tar-create is rsh’d to the remote system and is written to stdout (the pipe). The local system is extracting the tar that is being read from stdin (the pipe).
From: abeloni
Another method is:
rcp -rp host1:/dir host2:/dir
------------------------------
Subject: 1.607: Where is DCE discussed?
DCE is the Distributed Computing Environment, which is roughly a flexible client-server architecture for heterogenous platforms. For more information, take a look in comp.soft-sys.dce.
------------------------------
Subject: 1.608: How do I make /var/spool/mail mountable?
In our cluster we share a /usr/local disk. We have a directory /usr/local/spool/mail and /var/spool/mail is soft-linked to it.
From: fred.Uni-Duisburg.DE (Fred Hucht)
Several problems has been reported on sharing the mail directory via NFS. The problems may occur when two or more sendmail daemons and/or
mail readers access a user’s mail file simultanously, because of NFS’ file locking mechanism.
We use another method here: Every user has one line in his/her xxx@mainserver.domain.nameCet e-mail est protégé contre les robots collecteurs de mails, votre navigateur doit accepter le Javascript pour le voir where xxx is the user node and mainserver.domain.name is the full hostname of one of the machines. Then all incoming mail to all machines is forwarded to mainserver, while mainserver ignores this line.
------------------------------
Subject: 1.611: How do I setup anonymous ftp on my AIX system?
Have a look at ’/usr/lpp/tcpip/samples/anon.ftp’. It is a shell script and will set up a anonymous ftp site on your local RS/6000. Note: the ftpd that comes with AIX does not support the display messages every time a user changes a directory or even when they login.
------------------------------
Subject: 1.612: Talk, getting notification.
If you are not getting notification (that someone wants to talk to you), use (swcons ‘tty‘ && mesg y) in one window. There are many variations of ’talk’ and finding compatible versions
for multiple operating systems can be tricky.
------------------------------
Subject: 1.613: Disabling software flow control; using RTS/CTS.
Different versions of AIX 3.2.5 respond differently to attempts to enable flow control (RTS/CTS signals). This section is an attempt to compile a list of different approaches.
The most straight forward is:
chdev -l ttyxx -a rts=yes
[ Note: ix40410 for AIX 3.2.5 should give you this functionality. PTF U426113 and numerous other superceding ptfs should provide this.]
If carrier signal is high (its connected) you can try stty add rts ------------------------------
Subject: 1.615: Why can’t non-anonymous users login using WU-FTP?
You must create a file named /etc/shells (this is the real /etc not a subdirectory of your false root), that contains all the shells that are defined on your system. Get the list from /etc/security/login.cfg. Also, if having proper group authentication is important to you, apply the following patch:
--- ftpd.c.dist Wed Apr 13 15:17:18 1994
+++ ftpd.c Tue Jan 17 13:29:58 1995
@@ -1153,7 +1153,13 @@
setgroups(NULL, NULL);
if (setpriv(PRIV_SET|PRIV_INHERITED|PRIV_EFFECTIVE|PRIV_BEQUEATH,
&priv, sizeof(priv_t)) < 0 ||
- setuidx(ID_REAL|ID_EFFECTIVE, (uid_t)pw->pw_uid) < 0 ||
+ initgroups(pw->pw_name, (gid_t)pw->pw_gid) < 0 ||
+ setgidx(ID_REAL|ID_EFFECTIVE, (gid_t)pw->pw_gid) < 0 ||
+ setegid((gid_t)pw->pw_gid) < 0) {
+ reply(550, "Can’t set gid (AIX3).");
+ goto bad;
+ }
+ if (setuidx(ID_REAL|ID_EFFECTIVE, (uid_t)pw->pw_uid) < 0 ||
seteuid((uid_t)pw->pw_uid) < 0) {
reply(550, "Can’t set uid (AIX3).");
goto bad;
------------------------------
Subject: 1.616: NIS users can’t login, do I need ’*’ in /etc/passwd?
Aparently at least one version of AIX InfoExplorer suggests administrators use "+:*:0:0:::" as the last entry in the /etc/passwd file of NIS clients for security reasons. If the configuration SMIT is done using SMIT it will actually append "+::0:0:::" which works and does not compromise security. Using the ’*’ in the passwd field actaully prevents NIS users from logging in. "+::0:0:::" should not allow you to login as user "+" and without a password even when NIS is disabled, but it never hurts to double check.
------------------------------
Subject: 1.619: What modem settings do I need?
ATQ2 - result codes in originate only
AT&C1 - CD follows state of carrier
AT&D2 - hangup on DTR drop
------------------------------
Subject: 1.620: NIS slave server config with master on different subnet?
Assuming AIX 3.2.5,the master server up and running and the hosts file has the master name defined. On slave do:
1) domainname
2) startsrv -s ypserv
3) startsrv -s ypbind (ypwhich should return "loopback")
4) (/usr/sbin/)ypset -d (ypwhich should return ""
5) (/usr/sbin/)ypinit -s
6) Put "+::0:0:::" in /etc/passwd after last local login.
Note: InfoExplorer has this entry INCORRECT in some versions.
7) Other cfg files (group, etc) may need configuring but this will get ypserv and ypbind running on the slave looking at the right stuff.
------------------------------
Subject: 1.621: Why does my 64 port concentrator loose data and drop the queue?
This problem has been associated with upgrading machines to 3.2.5. Try changing the values for the "Transmit buffer count" parameter in the printer/plotter setup in smit. You need to experiment with this parameter, to see which value that makes the printer print as fast as possible. If the value is too high, the printers will loose some of the data, and the queue will be disabled. If the value is too low, the printers will print very slowly.
------------------------------
Subject: 1.625: How do I get NFS mounting with Linux to work?
Linux by default requires any NFS mount to use a so called reserved port below 1024 and AIX 4.3 does by default use ports above 1024. You can use the nfso command to restrict AIX to the reserved port range as follows:
nfso -o nfs_use_reserved_ports=1
------------------------------
Subject: 1.626: Telnet takes a 45 seconds to produce a prompt.
This is in nearly all cases a DNS configuration problem, the AIX machine can not resolve the IP address of the node initiating the telnet connection. You can check the DNS reverse mapping by using the nslookup command on the IP number in question, this will probably timeout as well. Make sure that the nameserver lines in the /etc/resolv.conf file point to valid name servers. Some folks have reported that putting the following in /etc/netsvc.conf can help as well (see also Subject: 1.800): hosts=local,bind4



1.7 LVM
Subject: 1.702: How do I make a filesystem larger than 2Gb?
AIX 3.2.5 and preceeding versions are limited to 2 Gigabytes per filesystem. With AIX 4.1 IBM allows filesystems up to 64Gb (reference: Individual files are still limited to 2Gb. AIX 4.2 allows 128Gb filesystems and 64 Gb files. (See also question 1.706.). If you are having trouble creating a file greater than 1Mb it maybe because that is the default limit for your account, see ’smit users’ or /etc/security/limit.
------------------------------
Subject: 1.703: Chlv warning. Is the first 4k of a LV safe?
The first 4k of a raw LV are used to store control block. Applications that write to the raw disk can overwrite this section (common applications that do this are Oracle and Sybase). Commands that call getlvcb will generate a warning but succeed (since the control block exists in ODM. Don’t run synclvodm unless you really want to erase the first 4k and replace it with the info from the ODM.
(Johnny Shieh) has kindly provided the following explanation:
The logical volume control block (lvcb) is the first 512 bytes of a logical volume. This area holds important information such as the creation date of the logical volume, information about mirrored copies, and possible mount points in a journaled filesystem. Certain LVM commands are required to update the lvcb, as part of completeness algorithms in LVM. The old lvcb area is first read and analyzed to see if it is a valid lvcb. If the information is verified as valid lvcb information, then the lvcb is updated. If the information is not valid, then the lvcb update is not performed and the user is given the warning message:
Warning, cannot write lv control block data
Most of the time, this is a result of database programs accessing the raw logical volumes (and thus bypassing the journaled filesystem) as storage media. When this occurs, the information for the database is literally written over the lvcb. Although this may seem fatal, it is not the case. Once the lvcb has been overwritten, the user can still:
1) Extend a logical volume
2) Create mirrored copies of a logical volume
3) Remove the logical volume
4) Create a journaled filesystem with which to mount the logical volume (note that this will destroy any data sitting in the lvcb area)
However, there is a limitation caused by this deletion of the lvcb. The logical volumes with deleted lvcb’s face possible, incomplete importation into other AIX systems. During an "importvg", the LVM command will scan the lvcb’s of all defined logical volumes in a volume group for information concerning the logical volumes. Surprisingly, if the lvcb is deleted, the imported volume group will still define the logical volume to the new AIX system which is accessing this volume group, and the user can still access the raw logical volume. However, any journaled filesystem information is lost and the logical volume and its associated mount point won’t be imported into the new AIX system. The user must create new mount points and the availability of previous data stored in the filesystem is NOT assured. Also, during this import of a logical volume with an erased LVCB, some non-jfs information concerning the logical volume, which is displayed with the "lslv" command, cannot be found. When this occurs, the system uses default logical volume information to populate the logical volume’s ODM information. Thus, some output from the "lslv" will be inconsistent with the real logical volume. If logical volume copies still exist on the original disks, this information will not be correctly reflected in the ODM database. The user should use "rmlvcopy" and "mklvcopy" to rebuild any logical volume copies and synchronize the ODM. Finally, with an erased lvcb, the output from the "lslv" command might be misleading or unreliable.
------------------------------
Subject: 1.705: Why am I having trouble adding another disk to my VG?
In some instances, the user will experience a problem adding a new disk to an existing volume group or in the creation of a new volume group. The warning message provided by LVM will Not enough descriptor space left in this volume group. Either try adding a smaller PV or use another volume group. On every disk in a volume group, there exists an area called the Volume Group Descriptor Area (VGDA). This space is what allows the user to take a volume group to another AIX system and "importvg" that volume group into that AIX system. The VGDA contains the names of disks that make up the volume group, their physical sizes, partition mapping, logical volumes that exist in the volume group, and other pertinent LVM management information. When the user creates a volume group, the "mkvg" command defaults to allowing the new volume group to have a maximum of 32 disks in a volume group. However, as bigger disks have become more prevalent, this 32 disk limit is usually not achieved because the space in the VGDA is used up faster, as it accounts for the capacity on the bigger disks. This maximum VGDA space, for 32 disks, is a fixed size which is part of the LVM design. Large disks require more management mapping space in the VGDA, which causes the number and size of available disks to be added to the existing volume group to shrink. When a disk is added to a volume group, not only does the new disk get a copy of the updated VGDA, but all existing drives in the volume group must be able to accept the new, updated VGDA. The exception to this description of the maximum VGDA is rootvg. In order to provide AIX users more free space, when rootvg is created, "mkvg" does not use the maximum limit of 32 disks that are allowed into a volume group. Instead in AIX 3.2, the number of disks picked in the install menu of AIX is used as the reference number by "mkvg -d" during the creation of rootvg. For AIX 4.1, this "-d" number is 7 for one disk and one more for each additional disk picked. i.e. you pick two disks, the number is 8. you pick three disks, the number is 9, and so on..... This limit does not mean the user cannot add more disks to rootvg in the post-install phase. The amount of free space left in a VGDA, and thus the number of size of the disks added to a volume group, depends on the size and number of disks already defined for a volume group. However, this smaller size during rootvg creation implies that the user will be able to add fewer disks to rootvg than compared to a non-rootvg volume group. If the customer requires more VGDA space in the rootvg, then they should use the "mksysb" and "migratepv" commands to reconstruct and reorganize their rootvg (the only way to change the "-d" limitation is recreation of the rootvg).
Note: It is always strongly recommended that users do not place user data onto rootvg disks. This separation provides an extra degree of system integrity.
------------------------------
Subject: 1.706: What are the limits on a file, filesystem?
There are other limits but these come up most often. Logical Volumes do not _have_ to contain Journaled File Systems and therefore can be larger than 2GB even in 3.2.5.
File jfs-Filesystem
3.2.5 2GB 2GB
4.1.x 2GB 64GB
4.2 64GB 128GB
While it *might* be possible to create larger file systems, the limits shown here represent values that IBM has supposedly tested.
------------------------------
Subject: 1.708: How do I fix Volume Group Locked?
>From /usr/lpp/bos/README (AIX 3.2.5) and 1.800.IBM.4FAX #2809
If you get ’0516-266 publvodm: volume group rootvg is locked, try again’ or something similar, you can use (putlvodm -K ‘getlvodm -v ‘)
------------------------------
Subject: 1.710: What are the theoritical limits within the LVM?
-------------------------------------
LVM Limits within AIX (my perception)
-------------------------------------
The system may have 1 to 255 Volumes Groups (VG’s).
Each VG may contain 1 to 32 Physical Volumes (PV’s).
Each PV may contain upto 1016 Physical Partitions (PP’s).
Each PP may have a size (square of 2) from 1 to 256MB (1024MB for AIX 4.3). Therefore, if you can get hold of a 260,096 MB disk (one PV with 1016 x 256MB PPs), you can install 32 of these in a single VG giving you 8,323,072MB per VG. You may have up to 255 VG’s in one AIX system so you could (in theory) create the maximum addressable AIX storage area of 2,122,383,360 MB (2,072,640 GB or 2,024 TB or approx. 2 PB). This is based on the current limitations of AIX V4.1.
The limits for file and filesystem sizes are:
[Editor’s note: the original values in this mail appeared to be slightly wrong, I have corrected that to the values as per my interpretation of the AIX manual.]
AIX V3.2 Max filesystem size: 2,147,483,647 bytes (2 GB) Max single file size: 2,147,483,647 bytes (2 GB)
AIX V4.1 Max filesystem size: 1,099,511,627,776 bytes (1 TB) Max single file size: 2,147,483,647 bytes (2 GB)
AIX V4.2 Max filesystem size: 1,099,511,627,776 bytes (1 TB) Max single file size: 68,589,453,312 (~64 GB)
AIX V4.3 Max filesystem size: 1,099,511,627,776 bytes (1 TB) Max single file size: 68,589,453,312 (~64 GB)
The 1TB maximum file system size is given by the rule that each fragment must be addressable by an 28 bit number, with the largest fragment size being 4096 bytes (4096*2^28).



1.8 AIX 4.X
Subject: 1.800: How do I control how hostnames are resolved?
Information from AIX 4.1.2 Infoexplorer:
The default order can be overwritten by creating the configuration file, /etc/netsvc.conf and specifying the desired order. Both the default and /etc/netsvc.conf can be overwritten with the environment variable, NSORDER. If either the /etc/netsvc.conf file or environment variable, NSORDER are defined, then at least one value must be specified along with the option.
examples:
echo hosts = local,nis,bind >/etc/netsvc.conf
NSORDER=local,bind; export NSORDER



1.9 Miscellaneous
Subject: 1.903: How do I transfer files between AIX and DOS disks?
In the AIX package bos.dosutils are commands for transferring files between DOS diskettes and AIX. The commands are dosread, doswrite, dosdir, dosdel, and dosformat. Many users have mentioned that the mtools package from prep.ai.mit.edu is better than the native AIX programs.
------------------------------
Subject: 1.904: Where is the crypt program?
The crypt *program* (as opposed to the crypt subroutine) has been deleted, probably to conform to U.S. law regarding export of cryptographic technology. Other programs such as PGP are available, but their use and/or possesion may be subject to local laws and regulations. If anyone has a better answer to this question, feel free to contribute it.
------------------------------
Subject: 1.913: How do I determine the clock frequency of a RS/6000 by software ?
The answer seems to be "There is no way to find out the clock frequency with a piece of software".

index

How to mount a CD on different UNIX system 在不同的UNIX 系统 mount CD

How to add website into search engin of google.com or baidu.com 怎样把你的网站加到google or baidu 搜索引擎中去

Encounter problems when ftp to x8web.com

最新Google搜索关键字排行榜

Install JBOSS on Linux 在linux下安装jboss

几个jboss 基础问题，install,start,stop

JBOSS 3.0.4 配置及使用初步

Installation of JBOSS on AIX.在 AIX 安装 JBOSS 全过程

How to reduce PageSpace for AIX. 如何减小hd6 pagespace...

Google adsense 100个中文关键词

The content in the CDs of AIX5.3. 全部AIX5.3 CDs 内容列...

google adsense key words google 高价广告词

the contents in CDs of AIX5.2 AIX5.2 CDs 所有文件列表

How to synchronize time among AIX server. 怎样为 ibm ...

Error coda displayed on AIX LCD AIX 开机出现故障时的错误码

SCSI specifications SCSI 说明，最长能连到多少米

Description for all ports of AIX AIX 所有 ports 介绍

AIX note

Check how much memory being used检测有多少内存正被使用

How to control RS6000 thru Hyperterminal 如何通过PC机的超...

Win2000 命令全集

How to set up stand-Alone Web-based System Manager...

Unix system security一篇关于UNIX的安全教程

Unix KornShell memento 学习 Unix KornShell , ksh

How to change the limits on file size, memory use,...

How to set up Anonymous FTP on AIXAIX下匿名ftp的设置

How to change the AIX Login Herald改变 AXI Login 属性

Asynchronous I/O 全面地介绍 AIX 的 AIO , Asynchronous I/...

AIX System Tools for monitoring & adjustingAIX资源监控...

Special AIX system commands,alog,pwdck

AIX Security Checklist 详细的AIX 安全 Checklist

Compare File Systems on Different Machines怎样比较不同AI...

FIN_WAIT_2状态下的连接与Apache

Apache最新官方配置文件中文版。帮忙web服务器管理员更方便的对Apache进行配置

Apache + SSL Howto译文

How to get IP Address using Java用JAVA程序取得IP地址

How to install and configure Cvswebcvsweb安装

How to use CVS用CVS来管理自己的程序

Installing CVS

CVS使用速成配置

How to configure a secure DNS配置一个安全的chroot DNS

How to check DNS, named Version怎样核实DNS,named版本号

Root Nameservers List全世界根name 服务器

怎样查询一个DNS,如何发现DNS的漏洞

BIND Configuration File Guide - options Statement

BIND 9的FAQ

全面地理解DNS－BIND安装与配置

探查DNS服务器运行状况

How to set TTL of DNS如何设置生存时间（TTL）最好？

Building and configuring BIND 9 怎样建造一个BIND 9 DNS

BIND 8 to BIND 9 Migration Notes

BIND常见问题集

How to analyse DNS log全面分析DNS日志

TCP/IP详解

Win2000 commandsWin2000命令全集

Ftp使用指南

wu ftp服务器配置

用wu-ftpd架设FTP服务器

HP-UX常用命令

How to HP-UX system information怎样获取HP-UX的系统信息

How to set Time Zone for HP-UX怎样设置HP-UX 时区

HP-UX 11.0 Installation Checklist

HP-UX操作系统备份与恢复指南

HP-UX系统安装和配置

HP-UX系统维护常用配置文件

HP-UX 常用的维护命令

HP-UX 根磁盘故障后如何恢复?

怎样升级到HP-UX 11.0？

在HP－UX服务器上实现用户空间限制

HP-UX的内核参数的修改

how to reduce the size of var for HP-UXHP-UX如何改变/v...

How to find what is the version of C++ of HP-UXHP-...

在HP-UX下建立只归属于某个目录下的ftp账户

list

How to mount a CD on different UNIX system 在不同的UNIX 系统 mount CD

How to mount a CD on different UNIX system
在不同的UNIX 系统 mount CD

on AIX
mount -o ro -v cdrfs /dev/cd0 /mnt/cdrom
umount /mnt/cdrom

on HP-UX
mount -r /dev/dsk/c2t1d2 /mnt/cdrom
umount /mnt/cdrom

on Linux
mount -t iso9660 -r /dev/cdrom/mnt/cdrom
umount /mnt/cdrom

on Solaris mount -F hsfs -o ro /dev/dsk/c0t6d0s2 /mnt/cdrom
umount /mnt/cdrom

on Tru64
mount -r /dev/disk/cdrom0c /mnt/cdrom
umount /mnt/cdrom

Compare File Systems on Different Machines怎样比较不同AIX机器的文件系统

When file systems that exist on different machines should be identical but you suspect one is damaged, you can compare the file systems. The following procedure describes how to compare the attributes of a file system that resides on your current host (in this scenario, called orig_host) to the same file system on a remote host.

Log in to the remote host as the root user. For example:
tn juniper.mycompany.com


AIX Version 5
(C) Copyrights by IBM and by others 1982, 2002.
login: root
root's Password:
Using your favorite editor, edit the remote host's .rhosts file to add a stanza that allows the root user to execute secure remote commands. Use the following format for the new stanza:
orig_host root
The resulting .rhosts file might look similar to the following:
NIM.mycompany.com root
nim.mycompany.com root
host.othernetwork.com root
orig_host.mycompany.com root
Save your changes and exit the remote connection.
With root authority on orig_host, create another file using your favorite editor. For this scenario, the new file is named compareFS. For example:
vi compareFS
Insert the following text in this file, where FSname is the name of the file system that you want to compare, and remote_host is the name of the host on which the comparison file system resides:
FSname -> remote_host
install -v ;
Note:
In the install command line of this file, there must be a space between the -v parameter and the semicolon (;).
For example:

/home/jane/* -> juniper.mycompany.com
install -v ;
Save the file and exit the editor. The compareFS file is used as the distfile for the rdist command in the following step.
Type the following at the command prompt:
/usr/bin/rdist -f compareFS
Or, if you expect a significant amount of output from the comparison, send the output to a file name. For example:
/usr/bin/rdist -f compareFS > compareFS_output
The output lists any differences between the file systems.

For More Information
The rdist command description in AIX 5L Version 5.2 Commands Reference.
The ".rhosts File Format for TCP/IP" in the AIX 5L Version 5.2 Files Reference.
"Understanding the Secure Remote Commands" in the AIX 5L Version 5.2 Security Guide.

AIX Security Checklist 详细的AIX 安全 Checklist

A. This info taken from AIX Redbook.
*************************
High level AIX security Audit Checklist

- AIX Environment Overview
- Superuser access
- Login/password administration
- Monitoring suid/sgid programs
- System/user file/directory permission

1. AIX Environment Overview

- Record serial numbers of all keys, remove keys and store in
safe location. Lock systems in NORMAL or SECURE.
- Run error logger to check the error log : errpt -a |more
- Enable accounting per instructions found in AIX System
Management Guide or aix.accounting file via anonymous ftp at
ftp.vt.edu: /pub/cc/rs6000.
- Run tcbck, usrck, grpck after all AIX software installations.
- The following scrips are available via anonymous ftp at ftp.vt.edu:
/pub/cc/rs6000.

- sysinfo
- This script determines system inventory.

- Determine rootvg names: lsvg
- List physical vols in each rootvg:
lsvg -p rootvg
- List logical vols in each rootvg:
lsvg -l rootvg
- List physical volume information for each
disk: lspv hdiskX
lspv -p hdiskX
lspv -l hdiskX
- List software inventory: lslpp -l
- List software history: lslpp -h
- List system name, name of node, LAN network number,
AIX release number, AIX operating system version,
machine ID number:
uname -x
- List all hardware connected to system:
lsdev -C | sort -d
- List NFS status
lssrc -g nfs
- List inet service: inetserv -s -S -X
- List host table entries: hostent -S
- List nameserver entries: namerslv -s -I
- List network status: netstat -i
netstat -nr
- Examine failed logins:
/usr/bin/who '-s' '/etc/security/failedlogin'
- Examine user group definitions:
/usr/sbin/lsgroup '-fa' 'id' 'users' 'ALL'
- Examine user information:
/usr/sbin/lsuser '-fa' 'id' 'groups' 'home' 'auditclasses' 'login' \
'su' 'rlogin' 'telnet' 'ttys' 'ALL'

- tcpchk
- This script checks the status of your tcp
subsystem. It also determines who's using
.netrc, .rhosts files.
- Determine the TCP subsystems installed:
- lslpp -l |grep bos.net
- lssrc -g tcpip
- Searches for .rhosts, .netrc files:
find / -name '.rhosts' -print
find / -name '.netrc' -print
- Searches for hosts that can use r-commands:
if [ -x /usr/sbin/inetd -a -f /etc/hosts.equiv ]; then
echo " the following hosts are allowed to rsh, rcp, rlogin"
echo
cat /etc/hosts.equiv | grep -v "#"
echo " "
fi
- Checks to see who can submit remote print jobs
if [ -x /usr/sbin/inetd -a -f /etc/hosts.lpd ]; then
echo " the following hosts are allowed to submit remote print jobs"
echo " ONLY"
cat /etc/hosts.lpd | grep -v "#"
echo " "
fi

- tcbck
- see man pages for more information
- nfsck
- This script checks the status of your NFS and
NIS subsystems

- Checks to see if nfs is installed:
lslpp -l |/bin/grep nfs
- Check to see if nfs/nis is active:
lssrc -g nfs|/bin/grep active
- Checks to see if this system is an NFS server:
if [ -x /usr/sbin/nfsd -a -f /etc/exports ]; then
echo "This machine is an NFS server"
- Displays which directories are exported:
cat /etc/xtab
- Displays hosts that are exporting directories:
/usr/bin/showmount
- If the host is a client, show what's mounted
from remote systems:
mount | grep -v "^ "
- Checks to see if nis is active:
isypset=`domainname | /bin/grep "^[a-zA-Z]"`
- If so, display the NIS domainname:
/usr/bin/domainname
- nethwchk
- Lists connected network interfaces:
lsdev -C -c if

- Show which ones come up at boot:
odmget -q"value='up'" CuAt|grep name|cut -c10-12
- Show interface status:
ifconfig en0
ifconfig et0

2. Superuser Access

- Keep root users to a minimum
- Do: lsuser -f ALL
to see which userids each user can use with su.
- Audit su command.
- Make sure /etc/profile doesn't include current directory.
- Verify cron setup:

To allow root only:
- remove: /var/adm/cron/cron.deny
&
/var/adm/cron/cron.allow
To allow anyone to use it:
- touch cron.deny if it does not exist.
To explicitly allow a user and no one else except root:
- touch cron.allow
- put userid in it
To explicitly deny a user:
- touch cron.deny
- put userid in it

- Disable direct logins for root by setting: 'User can LOGIN REMOTELY?
= false' in SMIT CHANGE/SHOW User Characteristics Screen.

3. Login/password administration

- Define password/user characteristics in /etc/security/user,
/etc/security/mkuser.default, /etc/security/login.cfg
- Minimum requirements (defined in /etc/security/user):
- maxage=8
- maxrepeat=2
- minalpha=5
- mindiff=2
- maxrepeats=3
- Set minimum default values for smit user field
(defined in /etc/security/user),
for the DEFAULT stanza:
- admin=false
- login=true
- su=false
- daemon=true
- rlogin=false
- sugroups=ALL
- ttys=ALL
- auth1=SYSTEM
- auth2=NONE
- tpath=nosak
- umask=027
- expire=0

- Scan for password inconsistencies:
- run /usr/bin/pwdck -n ALL to report errors but not fix them.
- run /usr/bin/pwdck -y ALL to fix errors and report them.
- Scan for group inconsistencies:
- run /usr/sbin/grpck -n ALL to report errors but not fix them.
- run /usr/sbin/grpck -y ALL to fix errors and report them.
- Review /etc/passwd, /etc/security/passwd, /etc/group and
/etc/security/group regularly.
- If systems are NIS'd, use 'ypcat passwd' to get passwd file
in standard format and then run CRACK against it to check
for weak passwords. Use npasswd for proactive checking. Run
CRACK regularly to check for weak passwords. Run COPS regularly.
- Consider requiring passwords from two users to access critical
accounts. When logging in such account, you'll be prompted
for the account passwd and another users passwd. Enable this
feature by specifying the second account in the PRIMARY
AUTHENTICATION METHOD field of SMIT ADD USER screen.
This sets up a two-person login.
- Set system-wide default process limits in
/etc/security/limits.
- Set default group, shell, home dir and other default
attributes for users in /usr/lib/security/mkuser.default. Consider
changing the default group name from staff to something local.
- Set default environment variables in /etc/environment,
/etc/profile and /etc/security/environ.
- CAUTION: when using NIS, the passwd file can be displayed
in standard unix format rather than in the shadow passwd
form. Make sure your NIS domain name is a well kept secret.

4. SUID/SGID

- Review all suid/sgid programs owned by root, daemon, bin or
groups: bin, kmem, mail. Initial list should contain owner,
group, perms and checksum. All suid/sgid programs should be
mode 511 minimum
- Use: find / -perm -1000 -print
find / -perm -2000 -print
find / -perm -4000 -print
alternatively to search for setuid, setgid and sticky bit files.

5. System/user file/directory permissions

- System dirs should have perm 755 minimum.
- System dirs used by root for programs should be owned by root.
- Set sticky bit on /tmp, /usr/tmp
- UUCP, cron table, syslogs, system source code should be
closed to general users.
- AIX default for /usr/sbin/mount, /usr/sbin/acct/acctcom and
/usr/sbin/login, login is 555.
- Monitor checksums for : login, su, passwd, cu, crypt, tip and
rlogin. Use /usr/bin/sysck command to do this.
- Only one copy of system commands and these should be in the
system dir.
- Device file perms:
disk, storage, tape, network device files: 600, owned
by root.
tty device files: 622, owned by root.
/dev/null: 777
- List all hidden files in dirs (the .files)
- List all writable dirs. Use find command to do this.
- User HOME dirs should be mode 710. Mode 711 allows others
to inspect subdirs with permission.
- .profile, .login files should be mode 600 or 640.
- Set appropriate umask in /etc/profile
- Search for unowned files: find / -nouser -print
Do not remove files from /dev.
- Check for 'at' jobs owned by root and verify their function.
- Restrict r-command usage.


1. Advise users to not use rsh, rcp, rlogin, tftp unless
you have secured them. Do not use .rhosts,
/etc/hosts.equiv or .netrc files.

2. Run securetcpip command to disable these services.
Use tcpchk script to search for .netrc files.


3. Set /etc/hosts to 660. Review its contents regularly. .netrc should never be
used because they contain unencrypted password info.

4. The securetcpip command disables non-trusted daemons and
appls. It comments out the entries in /etc/inetd.conf and sets perms to
000 for the individual daemons.

stopsrc -g tcpip
securetcpip

It disables rshd, rlogind, tftpd, rlogin, rcp, rsh, tftp, trpt. It is
reversible. Note that xstations may use tftp to download server code to
them.

5. Check .rhosts, .netrc, /etc/hosts.equiv, /etc/hosts and
/etc/inetd.conf regularly against checklist version.

6. Use netstat -p tcp to look for failed connection attempts.

7. Verify contents of /etc/exports and run exportfs -av
to implements the changes.

8. Change ftp entry in /etc/inetd.conf to ftpd -l to enable logging.

9. Set permission of exported dirs to be as limited as
possible. Do NOT export high level dirs unless necessary.

10. Enable AIX auditing [Optional]

Set instructions in /etc/security/audit/config, events, objects,
bincmds and streamcmds.
- Events - defines the occurrences to be audited.
- Use auditpr command to set,
- Audit classes are defined in config.
- Audit record formats are found in /usr/include/sys/audit.h
- Audit event types: per process - to audit each process a user
runs, per object - to audit object accesses and the mode of
access (r, Rw, success/fail). objects are defined in objects.

General Steps:
- Save original /etc/security/audit/events and config
files
- Modify config file to audit selected events
- Determine when to start auditing and the format
(bin or stream).
- Enter: audit start
to enable auditing.
- Review the output after a certain period of time
to make sure it's what you want.

11. Use the '/usr/sbin/watch' command to observe audit events for a program
you're not sure of.

12. Set up a separate account to do software installs. For example, define
it as acct swinstall.

13. Use the tsh command to run a trusted command interpreter. This
executes commands that are marked as members of the Trusted Computing
Base (TCB). The 'shell' command exits the tsh state.

14. Use Access Control Lists to tighten security on file:
- /usr/bin/aclget - shows status of file
- /usr/bin/acledit - allows you to change perm status
- /usr/bin/aclput - write status to file

setenv EDITOR /usr/bin/vi

AIX Terminology - base ACL is standard Unix permission stuff
Extended ACL is what these commands give.
SUID, SGID are same but SVTX = sticky bit

Any user can create an extended ACL for any file they own.
Three keywords:
permit - allows user/group access
deny - forbids user/group access
specify - defines the file access

Base permission CANNOT override a 'deny' keyword. User AND Group
must match.


15. List all files in your system:
cd /
li -Ra -l -a > filename

save the output off-line.

16. Check for failed logins by: /usr/bin/who -s /etc/security/failedlogin

17. Do not allow IFS (input field separator) to be changed in
/etc/profile and monitor its usage in user profiles.

18. Default AIX file permissions are 644 for files and 755 for dirs.
Adjust accordingly. AIX allows only root to use the 'chown' command.
- Set user profile files to 740
- System dirs should have other perms = 0

19. Keep track of these administrative files and archive as necessary:
- usr/adm/cron/log
- /usr/adm/wtmp
- /usr/adm/pacct
- /var/adm/messages
- /var/adm/acct/nite/*
- /var/adm/dtmp
- /var/adm/qacct
- /var/adm/acct/sum/*
- /var/adm/acct/fiscal/*
- /usr/bin/mail/*
- /etc/utmp
- /etc/security/failedlogin

20. Do not use UUCP unless absolutely necessary.

21. Use the '/usr/bin/strings' command to check any suspicious binaries.

22. Consider implementing disk quotas on your systems. See man pages for the
'quota' command.

23. Route copies of syslogs to a central machine. Edit /etc/syslog.conf
and do the following:

1. Add the following line:
*.debug @host
where host is the hostname of the central machine.
2. Place authentication messages in a separate syslog file, for
example, /var/adm/seclog:
auth.debug /var/adm/seclog
3. Place others in a file other than the standard AIX syslog
file, /var/adm/messages.

24. Archive system logs by creating a shell script that does the
following:

1. cd /var/adm
2. mv -f messages messages.old
3. cp /dev/null messages
4. chmod 644 messages
5. ps ax |grep syslog
6. kill -1 (syslog pid # from step 5)
7. move messages.old to the archive site.

note: make sure you use the name of the syslog file in these steps.
The name 'messages' is the standard AIX syslog name and if you
changed the default name (per step 23), make sure you use that name.