topic Re: how to understand su syslog msg in Operating System - HP-UX

how to understand su syslog msg

dom kris — Wed, 07 Apr 2004 08:56:47 GMT

Hi,

in the syslog, I saw the following message:
"
syslog: su : + tty?? root-oracle
"

what does this mean exactly?
That the 'root' user did an su to 'oracle', but why is the tty 'tty??'?

Is this because it was a script that did an su?

Ay help much appreciated

Kris

Re: how to understand su syslog msg

Todd McDaniel_1 — Wed, 07 Apr 2004 09:06:11 GMT

yes...

root su'ed to oracle and was on tty?? which AFAIK means it couldnt determine the tty.

Re: how to understand su syslog msg

Todd McDaniel_1 — Wed, 07 Apr 2004 09:07:49 GMT

Actually it means that someone logged on DIRECTLY as root...

I just tried this and it showed my user ID b/c I su'ed to root then su'ed to oracle ...

Sulog recorded my userId and not root as su'er...

Re: how to understand su syslog msg

Jdamian — Wed, 07 Apr 2004 09:08:38 GMT

tty?? is the value to say 'su' command was not executed from a terminal.

Re: how to understand su syslog msg

dom kris — Wed, 07 Apr 2004 09:11:26 GMT

So if I understand it correctly, somebody logged in via the physical console and then 'su' to oracle?

What about rsh? Somebody doing as root (rsh system 'su oracle')?

Re: how to understand su syslog msg

Jdamian — Wed, 07 Apr 2004 09:20:45 GMT

I don't agree with Todd.

I log in console as user 'pete'.
Then su to superuser
su -

then su to user 'mark'...
the sulog file contains:

SU 04/07 16:14 + console pete-root
SU 04/07 16:16 + console pete-mark

No 'tty??' is shown.

'tty??' is shown when su is executed with no session attached. For instance:

su - mark -c /home/mark/list.sh

Re: how to understand su syslog msg

Bill Hassell — Wed, 07 Apr 2004 09:27:35 GMT

The tty?? is a placeholder when su is run in batch mode (ie, a cron script). There is no tty associated with a batch job.

Re: how to understand su syslog msg

Todd McDaniel_1 — Wed, 07 Apr 2004 09:27:42 GMT

they logged in via telnet as root... console uses "console" on my host...instead of tty

sulog shows this:

SU 04/07 09:26 + console root-oracle

so they used a telnet session which is dangerous... check your /etc/securttys.

Re: how to understand su syslog msg

Gary L. Paveza, Jr. — Wed, 07 Apr 2004 09:43:59 GMT

I see this one all the time when executing automatic startup scripts which start oracle.

Do you have dbstartup in your /sbin/init.d?