topic Re: SAP <sid>adm user's files in home directory change ownership with different logins in Operating System - HP-UX

SAP adm user's files in home directory change ownership with different logins

gbruner — Thu, 09 Nov 2006 17:50:12 GMT

Hi. I recently had to rebuild /home/adm because some of the config files got deleted or overwritten.. I think I missed something, because I have a problem when I log in as root and su to adm.. As root, if I look at the files in /home/adm, they are all owned by adm:sapsys. That is as it should be. If I su to adm and then look at files in /home/adm, I see that all files are owned by 3201:sapsys. 3201 happens to be the uid of the adm user. This is a problem because I cant run any sap processes with ownership like this.. Any ideas on where to look and what to look at? I know this much, .profile in /home/adm is pointing to run .sapenv_.sh.. and the standard template of .sapenv_.sh is being used..

Re: SAP adm user's files in home directory change ownership with different logins

Calandrello — Thu, 09 Nov 2006 17:58:01 GMT

Friend I find that you desire to modify home of user this if modifies in the /etc/passwd archive

Re: SAP adm user's files in home directory change ownership with different logins

TwoProc — Thu, 09 Nov 2006 18:01:07 GMT

If your not using NIS or LDAP to resolve user names, then it sounds to me like your /etc/passwd file is not publicly readable.

Check to see that /etc/passwd is readable by this user.

Re: SAP adm user's files in home directory change ownership with different logins

TwoProc — Thu, 09 Nov 2006 18:01:28 GMT

If your not using NIS or LDAP to resolve user names, then it sounds to me like your /etc/passwd file is not publicly readable.

Check to see that /etc/passwd is readable by user adm.

Re: SAP adm user's files in home directory change ownership with different logins

TwoProc — Thu, 09 Nov 2006 18:21:04 GMT

Sorry about the double post - the first post hung so long that I didn't think it was going through, so I edited it up a bit and resent. Excuse the extra posting.

Re: SAP adm user's files in home directory change ownership with different logins

gbruner — Thu, 09 Nov 2006 18:40:56 GMT

Thank you all! It works! I had recently changed /etc/passwd to 750 because SOX auditors said that it should be that way instead of 444.. Damn auditors.

Re: SAP adm user's files in home directory change ownership with different logins

TwoProc — Fri, 10 Nov 2006 10:38:52 GMT

That's funny!

Re: SAP adm user's files in home directory change ownership with different logins

Bill Hassell — Fri, 10 Nov 2006 21:44:39 GMT

...should be 750...

That's a very serious error. I would report this lack of experience/training of the auditors to upper management and to not make any further changes to your system until the validity of the recommendations can be verified with experts. The 750 recommendation is TOTALLY wrong since the passwd file must be readable by anyone (ll always reads the passwd file) and to make the passwd file executable is simply ignorant. NO file should be executable unless it is a script or a program. These auditors may know something about PCs but keep them off the Unix systems.

You can verify the correctness of ll the HP-UX file and directory permissions with the swverify command:

swverify

Warning: it will take a while and will load the system fairly heavily.