topic Re: su - root as root??? in Operating System - HP-UX

su - root as root???

Mike Barron_3 — Mon, 11 Jul 2005 13:39:47 GMT

Anyone ever see this in the syslog?:

Jul 11 03:03:35 pfuxdbp1 above message repeats 19 times
Jul 11 03:04:07 pfuxdbp1 su: + tty?? root-root
Jul 11 03:23:08 pfuxdbp1 su: + tty?? root-root

This is going on every minute....

Re: su - root as root???

Devender Khatana — Mon, 11 Jul 2005 13:44:19 GMT

Hi,

Any user when do a "su - root" this message gets logged. The tty reprents the tty session where that was done.

HTH,
Devender

Re: su - root as root???

Rick Garland — Mon, 11 Jul 2005 13:51:27 GMT

Seen this many times. We forget we are root when we do the su -

Every minute is something to investigate. Can start by looking at the /var/adm/sulog as well.

Re: su - root as root???

Patrick Wallek — Mon, 11 Jul 2005 13:51:33 GMT

I would check you root crontab file and look for any job running every minute. If there are any, then check those to see if they are doing an 'su - root'.

They may be doing an su to set some environment variables for a script. Or it could be the syntax 'su - root -c /dir/somescriptname'.

Cron would be my first check.

Re: su - root as root???

saju_2 — Mon, 11 Jul 2005 13:54:34 GMT

Hi

This is because su - root is executed. If this is seen in regular intervel then there will be some script in cron which runs in the background doing su - root.

Regrads
CS

Re: su - root as root???

Mike Barron_3 — Mon, 11 Jul 2005 13:58:02 GMT

the weird thing is I did check the cron and there are no jobs running every minute.

also its running as root and suing to root..

Re: su - root as root???

Patrick Wallek — Mon, 11 Jul 2005 14:02:48 GMT

What about 'at' jobs? What does 'at -l' show?

Do you happen to use a third party scheduler like Autosys, Maestro, IBM Tivoli Workload Scheduler?

What about some other process someone started? Try doing a 'ps -ef |grep sleep' and look for a 'sleep 60' or something similar. Then look at the sleep processes PPID and then look for that process id and see what it is.

Re: su - root as root???

Devender Khatana — Mon, 11 Jul 2005 14:03:40 GMT

Hi,

It could be a script of some non root user which has UID set & doing a su - root.

Su - root from root is usual in scripts.
#ps -ef|grep -i su at regular intervals shall help.

HTH,
Devender

Re: su - root as root???

Animesh Chakraborty — Mon, 11 Jul 2005 20:35:54 GMT

+ tty?? means it is running from cron job as no specific terminal is indicated.

Please ckeck your root cronjob again. It will be inside some scripts which are running via cron every 20 minutes.