topic Re: unauthorized device file--Local Security Finding in Operating System - HP-UX

unauthorized device file--Local Security Finding

SSO Montgomery — Thu, 13 Mar 2003 19:09:58 GMT

I don't know what is generating this file:

crw------- 1 root root 203 0x015000 Mar 12 11:17 /var/tmp/rdskKPJa04161

I deleted it and rebooted the machine (yesterday), and one reappeared. Apparently, a G076, local security, finding is generated when a character special (crw-----) device file is found outside the normal device directory structure.

Does anyone have any idea what may be generating this file??? Would appreaciate any ideas. This is a K370 system running 11.11, 64 bit.

crw------- 1 root root 203 0x015000 Mar 12 11:17 /var/tmp/rdskKPJa04161

Re: unauthorized device file--Local Security Finding

John Poff — Thu, 13 Mar 2003 19:15:36 GMT

Hi,

Here is a thread that says they are left behind when sam is improperly terminated. I just looked on a couple of our boxes and we have some of those old files out there too.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x0d7f972194d6d5118ff40090279cd0f9,00.html

JP

Re: unauthorized device file--Local Security Finding

Chris Wong — Thu, 13 Mar 2003 19:17:12 GMT

Did it show up immediately after the reboot (was it created during one of the startup processes?) or later?

Re: unauthorized device file--Local Security Finding

Jeff Schussele — Thu, 13 Mar 2003 19:19:41 GMT

Hi,

That's a ctl Class device using the sctl driver.
Most frequently used by the auto-loader fro tape libraries.
I have no clue *why* it's being created in /var/tmp, but I'd suspect that some sort of application (Tape Backup SW?) is doing this as /var/tmp is widely used by apps for temp storage.

Rgds,
Jeff

Re: unauthorized device file--Local Security Finding

SSO Montgomery — Thu, 13 Mar 2003 19:41:33 GMT

Chris: Yes. It's the first thing I checked after the reboot.

Others: Will get back to you after checking out backup processes/procedures.

Thanks.

Re: unauthorized device file--Local Security Finding

SSO Montgomery — Fri, 04 Apr 2003 18:22:15 GMT

Everyone:

Thank you so much. Was application doing tape_backup.

Chow.