topic Re: SU problem in Operating System - HP-UX

SU problem

abhijit chaphekar — Tue, 26 Sep 2000 18:35:16 GMT

i get error while using su "su: Your own ID is unknown."
please help
thanx

Re: SU problem

Stefan Farrelly — Tue, 26 Sep 2000 18:51:41 GMT

My only guess is that your current id is no longer in the passwd file, as when you su (to root) an entry must be added to the su log in /var/adm stating - root (+date/timestamp) and if your id isnt in the passwd file it cant add an entry to the su log. Check your id and that is currently in the passwd file.

Re: SU problem

abhijit chaphekar — Tue, 26 Sep 2000 20:33:27 GMT

stefan,

Iam root and when i try to "su" to other id's like oracle etc i get this error.The root is present in passwd file .

thanx in advance

Re: SU problem

James R. Ferguson — Tue, 26 Sep 2000 21:06:14 GMT

Hi:

I would check the password and group files and fix any errors found. Try the following:

# /usr/sbin/pwck
# /usr/sbin/grpck

...JRF...

Re: SU problem

Bruce Laughlin — Tue, 26 Sep 2000 23:42:49 GMT

Hi,

I'm going to make some assumptions about your system, based on things I know about su:

1) You're running 10.20
2) Your system is trusted.

Based on these assumptions, and knowing how su operates, I believe that su is attemtping to do a getprpwuid() call, which is failing, and thus generates the error message you're seeing. One possible cause of this is a damaged or missing entry for root in the Trusted Computing Database (TCB). For example:

# cd /
[root@ooodarn]/
# cd /tcb/files/auth/r
[root@ooodarn]/tcb/files/auth/r
# su bal
[root@ooodarn]/tcb/files/auth/r
# exit
[root@ooodarn]/tcb/files/auth/r
# mv root root.orig
[root@ooodarn]/tcb/files/auth/r
# su bal
su: Your own ID is unknown.
[root@ooodarn]/tcb/files/auth/r

Here's an example of a good /tcb/files/auth/r/root entry:
root:u_name=root:u_id#0:
:u_pwd=J7wCIvL3jn4IA:
:u_bootauth:u_auditid#0:
:u_auditflag#1:
:u_pswduser=root:u_suclog#970015107:u_lock@:chkent:

I suspect that when you recover or repair this file, your su problem will be solved.

Regards,
Bruce Laughlin

Re: SU problem

abhijit chaphekar — Wed, 27 Sep 2000 01:41:12 GMT

Bruce,

That is not the case here, as the file root under tcb is not changed.but the error is same.
any suggestion would be great help.

Thanx

Re: SU problem

Stefan Farrelly — Wed, 27 Sep 2000 08:36:14 GMT

Hi,

can you send us a copy of your /tcb/files/auth/r/root file so we can see if it looks ok (you can remove encrypted password string if you like for security reasons) ?
And a copy of your passwd file (as its a trusted system no password strings here) ?

Re: SU problem

Stefan Farrelly — Wed, 27 Sep 2000 08:38:46 GMT

Here are some links to similar errors and solutions; One of them should be your case, I hope!

http://europe-support2.external.hp.com/cki/bin/doc.pl/sid=711f1c6a15c17a3b6a/screen=ckiDisplayDocument?docId=200000024631896

http://europe-support2.external.hp.com/cki/bin/doc.pl/sid=711f1c6a15c17a3b6a/screen=ckiDisplayDocument?docId=200000015248058

http://europe-support2.external.hp.com/cki/bin/doc.pl/sid=711f1c6a15c17a3b6a/screen=ckiDisplayDocument?docId=200000024602421

Re: SU problem

Bruce Laughlin — Wed, 27 Sep 2000 11:47:58 GMT

Hi Abhijit,

I'm reasonably sure that there is something wrong with your /tcb/files/auth/r/root file, we just don't know what it is yet :-)

I noticed in my previous post, some of the characters did not show up in my message. Specifically, each of the lines in the file, except the last, should be terminated with a backslash which is the line continuation character. If the line is not terminated this way, or is otherwise corrupted (i.e. missing characters, extra characters), su will fail in the same way.

Hope this helps,
Bruce Laughlin

Re: SU problem

abhijit chaphekar — Thu, 28 Sep 2000 21:06:53 GMT

Hi Stefan/Bruce,

The password file and root file is attached with this message.Please view them.

regards,

Re: SU problem

Bruce Laughlin — Sat, 30 Sep 2000 02:57:17 GMT

Hmm... well, you've got me baffled... almost. I know that the error is resulting because getprpwuid() isn't able to read the TCB file. The only other reason I can think of that this would happen would be some sort of permissions problem.

1) I notice that you have lots of users with uid 0 in your password file. When you say you're executing su as root, do you mean that you're logged in as the root user, or one of these other so-called root users?
2) If not logged in as root, are you su'ing to root from another user?
3) Check the permissions on /usr/bin/su, it should be 4555, owner root, group bin:
# ll /usr/bin/su
-r-sr-xr-x 1 root bin 20480 Jun 10 1996 /usr/bin/su

If this doesn't give a clue as to what's going on, then I'm out of ideas, for now...

Bruce

Re: SU problem

Devbinder Singh Marway — Sun, 01 Oct 2000 13:28:29 GMT

Try running authck -a ( checks the authentication dbase for inconsistencies )

see what this reports .

Re: SU problem

Devbinder Singh Marway — Sun, 01 Oct 2000 13:51:16 GMT

one thing looking at your password file is
roots home directory is /usr1/root , is this correct ?

Re: SU problem

Vincente Fernandes — Mon, 02 Oct 2000 09:22:07 GMT

Abhijit,
Trace your login flow on the server. Do you use any IBBS control S/W or audit S/W. I guess sometime back Citi started implementing audit control S/W(Forget the exact application name). I guess your are part of Citicorp-Bombay. As per my past experiences with Citicorp HP systems they have their own su written. Also check and make sure "su" file path is the standard as per HP-UX. I had good experience with Citicorp audit software while supporting the said citicorp countries from Bahrain. Mail me at vincentef@hotmail.com if you want any help.

Re: SU problem

Sanjay Dudeja — Mon, 02 Oct 2000 10:16:15 GMT

Hi Abhijit,

The following could be your problem -
When you created oracle id on your system it assigned a Authentication number. The tcb file of oracle will have that number stored. Once you remove the same your problem should be sorted out.

The entry in your tcb file will look like this
:u_pw_admin_num#197

I have faced this problem a number of times.

Re: SU problem

abhijit chaphekar — Tue, 03 Oct 2000 05:51:42 GMT

Hi guys,

Thanx for the help. The tcb database was corrupted .we had to rebuid it .
authck did help me to track the error.