Re: ticlts, ticots, ticotsord ...

From: Darren Moffat (Darren.Moffat@eng.sun.com)
Date: 08/06/01 

Message-Id: <200108061902.f76J2rs171931@jurassic.eng.sun.com>
Date: Mon, 6 Aug 2001 12:01:35 -0700 (PDT)
From: Darren Moffat <Darren.Moffat@eng.sun.com>
Subject: Re: ticlts, ticots, ticotsord ...
To: focus-sun@securityfocus.com, jpv@jpv.xs4all.nl

>We traced the problems to the files:
>/etc/net/ticlts/hosts
>/etc/net/ticots/hosts
>/etc/net/ticotsord/hosts
>
>Which are identical and contained hostnames from way back, on
>installation, when hosts had entirely different names, on a
>test-network...

For future reference there are two correct methods for changing the
hostname and/or IP addresess of a Solaris machine.

1) Run sys-unconfig
2) Follow SunSolve InfoDoc 21252
   This is also described in the Answerbook at:
   
http://docs.sun.com:80/ab2/@LegacyPageView?Ab2Lang=C&Ab2Enc=iso-8859-1&toc=SUN
Wab_47_2%3A%2Fsafedir%2Fspace3%2Fcoll1%2FSUNWaadm%2Ftoc%2FCAT%3A1097;bt=Common
+Administration+Tasks;ps=ps%2FSUNWab_47_2%2FCAT%2F05.Examining_and_Changing_Sy
stem_Informa#7
   
>Now, we've read the manpages, and kinda deduced that these files are
>used when only a loopback device is available (e.g. Single User
>Mode)... But we're at a loss of when and how these device(s) come into
>the picture and what they precisely do...

Not quite true. There are a number of services in Solaris that bind
explicitly to one of these transports so that the service they provide
is available only to the local host, eg:

rpcinfo | grep keyserv
    100029 1 ticlts borg.keyserv keyserv superuser
    100029 1 ticotsord borg.keyserv keyserv superuser
    100029 1 ticots borg.keyserv keyserv superuser
    100029 2 ticlts borg.keyserv keyserv superuser
    100029 2 ticotsord borg.keyserv keyserv superuser
    100029 2 ticots borg.keyserv keyserv superuser
    100029 3 ticlts borg.keyserv keyserv superuser
    100029 3 ticotsord borg.keyserv keyserv superuser
    100029 3 ticots borg.keyserv keyserv superuser
    
>Does anybody have some info or documentation (URLs ?) on these files,
>or info associated with them ?

What more do you want to know ? 

--
Darren J Moffat