topic Re: Crontab remove in Operating System - HP-UX

Crontab remove

Paul_481 — Fri, 17 Dec 2004 05:48:28 GMT

Guys,

Need help here, I am running on HPUX 11.00. I came to the office this morning and found that on of the user profile's crontab are gone as well as the command prompt of the user is change. This username is an application user.

The only clue that I have is the .profile of the user was modified around 0007H ( Dec 17).

Is there a way to check how that happened?

Thanks,

Paul

Re: Crontab remove

Fred Ruffet — Fri, 17 Dec 2004 06:00:51 GMT

You can try to see his last connections and last root's connection with the "last" command.

Maybe there are still traces in .sh_history in user's and root home directories.

Regards,

Fred

Re: Crontab remove

Paul_481 — Fri, 17 Dec 2004 06:26:15 GMT

Problem is /var/adm/wtmp is non-existent.

Re: Crontab remove

Robert-Jan Goossens — Fri, 17 Dec 2004 06:31:30 GMT

Hi Paul,

Does this user have a history file ?

# cat /$HOME/.sh_history

Regards,
Robert-Jan

Re: Crontab remove

Paul_481 — Fri, 17 Dec 2004 07:07:29 GMT

yes it has, but i cant see any command executed that could remove the cron.

Currently the system don't have any /var/adm/wtmp. How do I recreated it?

Regards,

Paul

Re: Crontab remove

Fred Ruffet — Fri, 17 Dec 2004 08:15:50 GMT

What about root's .sh_history ?

(I don't know what process populates wtmp file)

Regards,

Fred

Re: Crontab remove

Bill Hassell — Fri, 17 Dec 2004 08:53:02 GMT

From the wtmp man page:

"Also note that wtmp and btmp are not created by the programs that maintain them. Thus, if these files are removed, record-keeping is turned off."

Oops. Some root user probably saw wtmp getting large and simply removed it (ouch!) so commands like last will no longer produce anything. wtmp can be created with:

touch /var/adm/wtmp
chmod 664 /var/adm/wtmp
chown adm:adm /var/adm/wtmp

Also make sure that /var/adm/btmp exists. If not, use the touch/chmod/chown as above BUT make sure chmod is 640 (NO ONE gets to read btmp except root). lastb is the command that formats the btmp file.

As far as the culprit that made the changes, the user may not have made the changes, a root user ocould have done the deed. Check for duplicate root users:

logins -d

Multiple UID=0 is a BIG security no-no and one of the first hacks made by an intruder. You can also grep through all the /home/*/.sh_history files:

grep username /home/*/.sh_history

Also check if any of the HOME directories have missing .sh_history files, zero'ed .sh_history files, or the permission/ownership on the .sh_history file prevents the owner's shell from recording any commands. Any of those 3 conditions needs to be investigated.

Re: Crontab remove

Stuart Abramson — Fri, 17 Dec 2004 08:58:10 GMT

Reload the missing files from Backup Tapes.

You had better have Backup Tapes.

Re: Crontab remove

Paul_481 — Sun, 19 Dec 2004 21:16:34 GMT

Thanks everyone for the reply, points will be assigned later.

I happened to look at the console of the server and on the screen it has "cron job aborted " message.

Any ideas on what it mean?

Re: Crontab remove

Nguyen Anh Tien — Sun, 19 Dec 2004 21:47:33 GMT

1. Check .profile to determine whether history is set or not
vi /$USER_HOME_DIRECTORY/.profile
--- search this line---
export HISTFILE=/.sh_history
if it exits, history is set on your system for that user.

2. If user have a history file, check user's history file to know what happend
# vi /$USER_HOME_DIRECTORY/.sh_history