Downsizing the default RT Linux installation

[sirluke]

Hi,

I'm trying to streamline and increasing the security of the base NI Linux installation on sbRIO-9651 (LV2014). I have several questions to ask:

1. inside the /bin folder there is a tar.tar file which does not appear to be a tar archive. What is it?
2. the /etc/nsswitch.conf file does not have a known user and group, is it correct?

admin@OBI-3-rev000-001:/etc# ls -l nsswitch.conf

-rw-r--r--    1 63005    63005          584 Jun 24 21:31 nsswitch.conf

3. I see a lot of system users that in my opinion could be removed since they might pose a security threat to the system, can you help identifying the users that can actually be safely removed?

root:*:0:0:root:/home/admin:/bin/sh

daemon:x:1:1:daemon:/usr/sbin:/bin/sh

bin:x:2:2:bin:/bin:/bin/sh

sys:x:3:3:sys:/dev:/bin/sh

sync:x:4:65534:sync:/bin:/bin/sync

games:x:5:60:games:/usr/games:/bin/sh

man:x:6:12:man:/var/cache/man:/bin/sh

lp:x:7:7:lp:/var/spool/lpd:/bin/sh

mail:x:8:8:mail:/var/mail:/bin/sh

news:x:9:9:news:/var/spool/news:/bin/sh

uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh

proxy:x:13:13:proxy:/bin:/bin/sh

www-data:x:33:33:www-data:/var/www:/bin/sh

backup:x:34:34:backup:/var/backups:/bin/sh

list:x:38:38:Mailing List Manager:/var/list:/bin/sh

irc:x:39:39:ircd:/var/run/ircd:/bin/sh

gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh

nobody:x:65534:65534:nobody:/nonexistent:/bin/sh

messagebus:x:999:998::/var/lib/dbus:/bin/false

avahi:x:998:997::/var/run/avahi-daemon:/bin/false

avahi-autoipd:x:997:996:Avahi autoip daemon:/var/run/avahi-autoipd:/bin/false

lvuser:x:500:500:LabVIEW user:/home/lvuser:/bin/sh

openvpn:x:499:499:OpenVPN:/home/openvpn:/bin/sh

webserv:x:501:500:Web services user:/home/webserv:/bin/sh

sshd:x:498:497::/var/run/sshd:/bin/false

4. I see that the adduser and deluser commands are not present in the busybox version on the sbRIO, are there equivalent commands available?

Thanks

Luca

[Haris_Okanovic]

Hi Luca,

3. I see a lot of system users that in my opinion could be removed since they might pose a security threat to the system, can you help identifying the users that can actually be safely removed?

4. I see that the adduser and deluser commands are not present in the busybox version on the sbRIO, are there equivalent commands available?

There is presently no supported way to remove those user accounts from the NI Linux RT distribution. These accounts are all disabled by default and are not capable of logging in via network protocols like WebDAV, SSH, etc.

It's possible to remove them manually by editing /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow with a text editor. However, please keep in mind that removing these system accounts is not supported by National Instruments and may cause NI Linux RT targets to malfunction.

1. the /etc/nsswitch.conf file does not have a known user and group, is it correct?

We're aware of this issue and we're working to correct it.