topic Re: Restricted SAM: Script aborted in Operating System - HP-UX

Restricted SAM: Script aborted

Mad_1 — Thu, 09 Oct 2003 21:47:42 GMT

I configured a RSAM item for the account "oper" to run a script which owned by account "sybase" in HP-UX 11.0 platform.

If the RSAM item is executed by "sybase", no problem found. But when the RSAM item is executed by "oper", the script aborted.

My understanding is the RSAM would "su" to sybase to execute the script. How come the script abort. Therefore, I insert a line into the script show the user id. The result is:

When run by sybase: The "id" showed:
uid=101(sybase) gid=101(sybase) groups=103(sybase's 2nd group1),351(sybases's 2nd group2)

When run by oper: The "id" showed:
uid=101(sybase) gid=101(sybase) groups=20(users),212(oper's 2nd group1),320(oper's 2nd group2),351(oper's 2nd group3)

Do you have any idea about this? Thanks.

Re: Restricted SAM: Script aborted

Rajeev Shukla — Thu, 09 Oct 2003 21:59:54 GMT

Hi,

Have a look at other environment varibles required to run that script.
See when you run the script as sybase it might have all the ENV varaibles but with other user it might not as you are doing just su.
So see if you are exporting all the varaibles it requires before you run the script.

Cheers
Rajeev

Re: Restricted SAM: Script aborted

Steven E. Protter — Thu, 09 Oct 2003 22:03:13 GMT

My understanding is that you have to set up the oper account in restricted sam itself. I think you do this with the sam -r command. That lets you authorize the user explicitly.

To get a script execute as another user, the following methodology is reauried:

su - username -c "command"

That lets root su - and execute commands as sybase or oracle or anybody.

SEP

Re: Restricted SAM: Script aborted

Mad_1 — Thu, 09 Oct 2003 23:04:03 GMT

I inserted "env" into the script. Found that all sybase environment variables are included even running by "oper", however, several system environment variables are still remained as "oper", such as

LOGNAME=oper
HOME=/home/oper
PWD=/home/oper

It seems problem may be caused by this.

But how to avoid this, how come RSAM won't change this also?