topic Re: su shows wrong user in Operating System - HP-UX

su shows wrong user

Ben Thomas — Fri, 25 Apr 2003 15:20:40 GMT

Running HP-UX 11.00 in trusted mode.
su from root to another user, but sulog shows another user. e.g.
SU 04/25 11:09 + 0 panama-maestro
Also mail from root is recorded as from "panama".
pwck -s does not display any errors, and there are no duplicate UID's.
I assume problem is with authentication database, but have no idea how to fix it!
Any help would be greatly appreciated.

Re: su shows wrong user

Sachin Patel — Fri, 25 Apr 2003 15:32:51 GMT

Hi Ben here is what happening.

I am login as user sachin then run su - to become root then run su - patel and look what happen.

# whoami
root
# who am i
sachin pts/3 Apr 25 11:05

#su - patel
patel%exit
#tail -2 /var/adm/sulog
SU 04/25 11:25 + 3 sachin-root
SU 04/25 11:27 + 3 sachin-patel

But if you login to system via telnet as user root look what happens

#telnet rem1
Trying...
Connected to rem1.test.com.
Escape character is '^]'.
Local flow control on
Telnet TERMINAL-SPEED option ON

HP-UX sagan B.11.00 U 9000/800 (t0)

login: root
Password:

#su - patel
patel%exit
#tail -1 /var/adm/sulog
SU 04/25 11:29 + t0 root-patel

Conclusion: if you run su - then it source your profile so you have entry like
SU 04/25 11:09 + 0 panama-maestro

Sachin

Re: su shows wrong user

Steven E. Protter — Fri, 25 Apr 2003 15:34:45 GMT

If the system was created by Ignite and the /etc/passwd file wasn't included, this could cause the problem.

If its not an Ingite problem then:

1) A manual change has been made to /etc/passwd

2) The user panama actually did su to root and knows the password.

I am gessing there is an error in /etc/passwd that doesn't show up on pwck -s

log on.

Try this:

whoami
who am i

Do the su thing.

whoami
who am i

See if that sheds any light on the situation.

SEP

Re: su shows wrong user

Ben Thomas — Fri, 25 Apr 2003 18:39:03 GMT

Thanks for the comments, but does not help.
When logging in as root, we do not 'su' to root but are logged in using SSH. While logged in, running a tail on the sulog you can see the message "su : + 0 panama-maestro".
Also, all mail messages generated by root appear to come from 'panama' -- which does NOT have UID=0.
We have 25 HP systems, and this is the only one that does this.... It does not interfere with production, as it only seems to occur to the 'root' account -- but it is really weird.

Re: su shows wrong user

Dario_1 — Fri, 25 Apr 2003 18:44:46 GMT

Hi:

Run the id command in both accounts and compare the output.

Regards,

DR

Re: su shows wrong user

Michael Tully — Fri, 25 Apr 2003 22:12:35 GMT

Hi Ben,

I had a similar problem back in December.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x92640fe6d0f7d61190050090279cd0f9,00.html

I never did solve it, and it has not come back to play either. I have a feeling it ended up being some corruption in the /etc/utmp or /var/adm/wtmp file. Once that system rebooted and new Xtmp files were created the lady with the tarot cards never dealt me another hand.

Regards
Michael

Re: su shows wrong user

doug hosking — Mon, 28 Apr 2003 23:40:32 GMT

I'm suspicious that the problem is related to stale entries in /etc/utmp or /etc/utmpx.
If the machine can be easily rebooted I would be tempted to try renaming /etc/utmp and /etc/utmpx, 'touch'ing them back and resetting the original owner/group/mode then rebooting.

Re: su shows wrong user

Stuart Campbell — Thu, 13 Nov 2003 11:10:46 GMT

I am having a similar problem with HP-UX 11.00
When I login using tty tyb and su to root it shows the su as a different user. It only happens on tyb and it is always the same user.