topic Re: /lib losed in Operating System - HP-UX

/lib losed

piyut_1 — Mon, 28 Feb 2005 06:16:02 GMT

gurus,

why /lib that link to /usr/lib losed itself??
how can root access only by sysadmin???

Re: /lib losed

Steven E. Protter — Mon, 28 Feb 2005 06:27:40 GMT

root access is only by sysadmin because only a systems administrator should be messing around with some things that root has access.

sysadmin=root user
root user should be sysadmin.

Wondering if you recently upgraded from HP-UX 9 to 10 or above or something.

If that link is gone it was either erased or it was damaged by some kind of hardware failure.

IT may not be time to check hardware and restore this system to a known, working backup, at least vg00.

SEP

Re: /lib losed

piyut_1 — Mon, 28 Feb 2005 07:14:10 GMT

can common user access as root with .rhosts or other configurations file???
i just disable rlogin in my server hp-ux B 11.11.
what use of /lib ????

Re: /lib losed

Gordon Morrison — Mon, 28 Feb 2005 10:24:50 GMT

/lib should be a symbolic link to /usr/lib
If the link is not there, re-create it like this:
ln -s /usr/lib /lib

I believe the link exists for backward-compatibility: lib used to be /lib, but then they decided to move it to /usr/lib and they created the link to that old software would still be able to find it.

I think it is possible for a non-root user to rlogin as root without a password if root's .rhosts is set up to allow it. If it is, I would change it immediately. The use of .rhosts is very convenient, but very insecure.

Re: /lib losed

piyut_1 — Mon, 28 Feb 2005 20:19:31 GMT

gurus,

i don't find .rhosts that enable non-root user to login as root.in /etc/sudoers only one non-root user that can sudo as root without password, he is me.now,/lib is gone again.how come???

Re: /lib losed

Gordon Morrison — Tue, 01 Mar 2005 04:41:37 GMT

This sounds suspiciously like someone has created (or changed) a cron job to periodically delete it, and possibly other things. Have any disgruntled employees recently left your company?
Also check for suspicious at jobs that re-spawn themselves.
Also check sulog and syslog, as someone may have the password and just not know what they're doing.
It would probably be an idea to change the password if you haven't already.