topic Re: manually executed script in Operating System - HP-UX

manually executed script

Jonathan Grymes — Thu, 29 Nov 2007 09:12:07 GMT

After I execute the script (as root) it returns Mail sent.
# ./CheckFileSystems

Sending mail...
Mail sent!
#

When I check /var/mail/root I see the following entry:
for root; Thu, 29 Nov 2007 07:21:00 -0500 (EST)
Date: Thu, 29 Nov 2007 07:21:00 -0500 (EST)
From: root@fgexsh41.vad.ws-gex.com
Message-Id: <200711291221.lATCL0612170@fgexsh41.vad.ws-gex.com>

Cron: Your job did not contain a valid audit ID.
See your system administrator.

I was able to send mail via ELM so I know that is working.

Any thoughts?

Thanks,

Re: manually executed script

Steven E. Protter — Thu, 29 Nov 2007 09:23:48 GMT

Shalom,

This happens sometimes when converting systems with cron authorization to trusted mode.

Fix is found:
http://docs.hp.com/en/J4269-90041/J4269-90041.pdf

Its kinda buried in that document.

Here is how cron does it:
http://www.auditnet.org/docs/HPUX.doc
http://www.adager.com/VeSoft/HpUxSecurityConcerns.html

SEP

Re: manually executed script

Dave Hutton — Thu, 29 Nov 2007 09:28:52 GMT

I'm not totally following this. Are you saying when you run the script manually everything is fine?

roots email you show indicates to me that it was something from cron. Anything in /var/adm/cron/log around 7:21?
Usually if cron has an issue it will email root or the user it runs as.

Anything when you type crontab -l?

The only few hits I got when searching for that error is about tsconverting your system to trusted systems. Was that recently done?

What does cat /tcb/files/auth/r/root look like?

Re: manually executed script

Jonathan Grymes — Thu, 29 Nov 2007 09:45:39 GMT

The script is supposed to generate an email to send the results. I never receive it. The box was recently put in audit mode. I know ELM is working.

var/adm/cron/log:

> CMD: sleep 15;/etc/opt/resmon/lbin/mon_EMSHAProvider_state.sh
> root 11939 c Thu Nov 29 07:19:00 EST 2007
< root 11939 c Thu Nov 29 07:19:00 EST 2007 rc=1
> CMD: /opt/sfm/bin/restart_sfm.sh
> root 12112 c Thu Nov 29 07:20:00 EST 2007