topic Re: Tracing hosts file entry modification in Operating System - HP-UX

Tracing hosts file entry modification

bharath_hanuma — Mon, 26 Apr 2010 09:39:12 GMT

Hi All,

Two days back some of the entries in the host file got deleted. So I need to know how we can trace this so that we can find who has modified the file at that time.

Need your urgent help regarding the same.

Thanks and Regards
Bharath

Re: Tracing hosts file entry modification

Dennis Handly — Mon, 26 Apr 2010 09:44:42 GMT

The obvious answer is a sysadmin modified the file.
Without auditing, you really can't trace it.
I suppose you could look to see who login to root at that time or look at the shell history files or possibly anyone who did su or sudo.

Re: Tracing hosts file entry modification

bharath_hanuma — Mon, 26 Apr 2010 09:49:04 GMT

Hi Dennis,

Is there any command for checking the same. Also let me know how can I enable audut.log and also how frequently it grows.

Thanks and Regards
Bharath

Re: Tracing hosts file entry modification

R.O. — Mon, 26 Apr 2010 09:59:28 GMT

Yo can see the connection entries with "last" and see in syslog.log if any user did a "su - root". With these data you can guess who could do the change.
To enable auditing you have to convert to "trusted" your system. Yo can do it through SAM. If yo go to the audit zone in SAM it will ask you to convert the system.

Regards,

Re: Tracing hosts file entry modification

Dennis Handly — Mon, 26 Apr 2010 10:10:00 GMT

>Is there any command for checking the same.

Not after the fact, if you don't have auditing or have sudo.
You can only make some guesses based on the logs.

But it would be far easier just to ask the few sysadmins.

Re: Tracing hosts file entry modification

bharath_hanuma — Wed, 28 Apr 2010 05:32:07 GMT

Hi RO/Dennis,

I have checked through SAM regarding adding it as the trusted system. I would like to know if I add as trusted system, is there any impact on network configuration or reachability to customer systems or there will configuration changes on systems side.

Kindly need your suggestions or help regarding the same.

Thanks and Regards
Bharath

Re: Tracing hosts file entry modification

Dennis Handly — Wed, 28 Apr 2010 07:06:06 GMT

>I have checked through SAM regarding adding it as the trusted system. I would like to know if I add as trusted system, is there any impact on network configuration or reachability to customer systems or there will configuration changes on systems side.

There shouldn't be.
You may have users that think they have passwords longer than 8 chars that won't work.

You still need to turn on auditing and that will require careful monitoring of the massive amount of space used.

Re: Tracing hosts file entry modification

R.O. — Wed, 28 Apr 2010 07:17:55 GMT

Hi,

Just in case, do not log off root after converting the system. If you have any problem loging into the system as root, you can fix it or even unconvert the system because you are still logged. So, after the conversion, try to log in the system with a new session.
Be sure that you have these lines right defined in your "/etc/nsswitch.conf":

passwd: files
group: files

instead of:

passwd: compat
group: compat

I have recently converted a system and I couldn't login as root because I had these to lines as "compat".

Regards,

Re: Tracing hosts file entry modification

irshad ali — Wed, 28 Apr 2010 09:31:54 GMT

hi bharat,

If /etc/nsswitch.conf file not persent, create it by copying from /etc/nsswitch.compat: then make changes

Re: Tracing hosts file entry modification

bharath_hanuma — Wed, 28 Apr 2010 09:42:37 GMT

Hi,

I have below contents under nsswitch.compat

# An example file that could be copied over to /etc/nsswitch.conf; it
# uses NIS (YP) in conjunction with files.
#

passwd: compat
group: compat
hosts: nis [NOTFOUND=return] files
networks: nis [NOTFOUND=return] files
protocols: nis [NOTFOUND=return] files
rpc: nis [NOTFOUND=return] files
publickey: nis [NOTFOUND=return] files
netgroup: nis [NOTFOUND=return] files
automount: files nis
aliases: files nis
services: nis [NOTFOUND=return] files

Kindly let me know what needs to be done in this file.

Regards

Re: Tracing hosts file entry modification

R.O. — Wed, 28 Apr 2010 10:34:51 GMT

Hi,

As said, create the file "nsswitch.conf" from "nsswitch.compat":

cd /etc
cp -p nsswitch.compat nsswitch.conf

Now, replace the lines for passwd and group for the correct ones (with files instead of compat) in file nsswitch.conf.

Regards,

Re: Tracing hosts file entry modification

R.O. — Wed, 28 Apr 2010 10:38:29 GMT

Hi,

Also replace in your newly created nsswitch.conf:

hosts: nis [NOTFOUND=return] files

for something like:

hosts: files [NOTFOUND=continue] dns

If you only use "/etc/hosts" for name resolution, put:

hosts: files

You have to configure this entry depending on how are you doing name resolution.

Regards,