topic Re: /dev/pts/tk possibly causing corrupution in /dev/utmp in Operating System - HP-UX

/dev/pts/tk possibly causing corrupution in /dev/utmp

John Dixon_5 — Thu, 23 Jun 2005 12:28:16 GMT

We have an application that is misreporting the username (vendor says it uses whoami, but whoami reports correctly even when the application is wrong). The misreporting seems to be tied to the /dev/pts/tk device. I am willing to remove this if it is ok or possibly even remove and then rebuild it. This is a little deeper than the knowledge I have and I'm unsure whether I might be treading on thin ice. Any help would be appreciated.

Re: /dev/pts/tk possibly causing corrupution in /dev/utmp

Kent Ostby — Thu, 23 Jun 2005 13:07:32 GMT

Well there shouldn't be any issue with /dev/pts/tk since its just like any other /dev/pts/t? file.

What is leading you to this conclusion ?

What is the OS revision and what is the product in question ?

Oz

Re: /dev/pts/tk possibly causing corrupution in /dev/utmp

John Dixon_5 — Thu, 23 Jun 2005 13:14:59 GMT

OS is HP/UX 11.11. It (tk) looked the same as the rest of the files (#, t*), but every instance where the user was misreported in Unidata (the database application which the application is built on and the one doing the misreporting) was from this port. The user it is reporting as being is not a unix user anymore. Totally baffled as to what is causing this. Thanks!

Re: /dev/pts/tk possibly causing corrupution in /dev/utmp

Kent Ostby — Thu, 23 Jun 2005 13:25:54 GMT

Have you checked to see what process is using that pty ? If that's the only pty that unidata uses then it is just an innocent victim in all of this.

What user ID is it reporting ?

Has that user ID been removed since unidata was started ? It may be that unidata is cacheing the user data ?

Re: /dev/pts/tk possibly causing corrupution in /dev/utmp

Jeff Schussele — Thu, 23 Jun 2005 15:00:22 GMT

Hi John,

This is probably a symptom of the telnetd daemon binary needing to be patched.
I can't remember the exact patch name but if you search the forum for
telnetd + utmpx corruption
you should find an old post on it. But NOTE that you have to follow the patch's special instructions for it to work correctly.

HTH,
Jeff

Re: /dev/pts/tk possibly causing corrupution in /dev/utmp

Jeff Schussele — Thu, 23 Jun 2005 15:08:18 GMT

Found it - here it is PHNE_28841:

http://www2.itrc.hp.com/service/patch/patchDetail.do?BC=patch.breadcrumb.main|patch.breadcrumb.search|&patchid=PHNE_28841&context=hpux:800:11:11

And here's the salient problem entry:

SR 8606220839 / CR JAGad89975
3. Incorrect records might be written into /etc/utmpx
by telnetd when it exits.

Check to see if you have it & if not get & apply it. Again NOTE and follow the special instructions.

HTH,
Jeff