topic Re: Searching complete / for sudo in Operating System - HP-UX

Searching complete / for sudo

Hemant S. — Thu, 08 Jun 2006 12:13:21 GMT

Before upgrading sudo, we need to check if any scripts are using sudo. For this I tried to search ALL files using find / -exec grep -l 'sudo' {} \; > /tmp/result. But this hangs in between while searching lot of files and I can can not keep killing every process where it hangs.(Example /etc/opt/resmon/pipe/153355665 ) So what is the best way searching complete system.
I have generated a complete listing of files in system. This comes to 414874 files which we need to search. I am looking for some script where it should search all files in this listing without any wait period and if it hangs anywhere, ONLY then it should wait for 30 seconds and then kill the grep for that file and proceed to search on next file in listing. Or if there is any better way to do this. Thanks in advance.

Re: Searching complete / for sudo

Rick Garland — Thu, 08 Jun 2006 12:21:09 GMT

If you are upgrading sudo, are you keeping the same PATH to the executables?

If so there is no need to modify the scripts that contain the sudo call.

Re: Searching complete / for sudo

Christian Tremblay — Thu, 08 Jun 2006 12:25:04 GMT

It would be a lot easier to check the sudo log: /var/adm/syslog/sudo.log to see what scripts/users are using it.

But like Rick says, if your sudo stays at the same place when you upgrade it, there is no need to do anything, the scripts will
run the new version.

Re: Searching complete / for sudo

Hemant S. — Thu, 08 Jun 2006 12:30:19 GMT

The sudo we have on this box is very very OLD. Does not show any version. And command syntax is lot different from the rest sudo executable.
OLD@xxx:#sudo -V
usage: sudo [ [ -r | -e ] name ] [ cmd [ args ]]
sudo [ -l name ]
NEW!hxs $ sudo -V
Sudo version 1.6.6
Once I put this sudo 1.6.6, Some of scripts using sudo fail. So before going ahead of upgrade sudo on PROD systems I wanted to make sure how many scripts are using sudo. Find owners of those scripts, contact them and have them modify it.

Re: Searching complete / for sudo

Christian Tremblay — Thu, 08 Jun 2006 12:42:38 GMT

Like I said, check the sudo log, all invocations of sudo by a script are logged there with the name of the script that called it.

Re: Searching complete / for sudo

Hemant S. — Thu, 08 Jun 2006 12:47:53 GMT

There is no /var/adm/syslog/sudo.log present, or any other sudo log. The files which it use is /etc/suid_tab and /etc/suid_local not sudoers.

Re: Searching complete / for sudo

Christian Tremblay — Thu, 08 Jun 2006 12:51:37 GMT

by default sudo will log to the system log in /var/adm/syslog/syslog.log but it's a good idea to log to it's on log file
(configurable in the /etc/sudoers file)

You may check sudo entries in the system log
grep -i sudo /var/adm/syslog/syslog.log

Re: Searching complete / for sudo

Hemant S. — Thu, 08 Jun 2006 12:58:41 GMT

As I said there is no /etc/sudoers present. Also I don't want to depend on sudo entries in syslog.log. Is there any way to search ALL files in a system for use of command sudo.

Re: Searching complete / for sudo

Christian Tremblay — Thu, 08 Jun 2006 13:12:55 GMT

for i in `find / -type f`;do grep -i sudo $i;done 2>&1 >> search.out

Re: Searching complete / for sudo

Christian Tremblay — Thu, 08 Jun 2006 13:23:42 GMT

You may want to use grep -il to output only the file names where a match is found.

Re: Searching complete / for sudo

Hemant S. — Thu, 08 Jun 2006 13:26:50 GMT

Christian

This command hangs here -
# ll /etc/opt/resmon/pipe/1573980217
prw------- 1 root root 0 Jul 30 2003 /etc/opt/resmon/pipe/1573980217
# grep -il sudo /etc/opt/resmon/pipe/1573980217

Thats why I am looking for some scripts. Please see my question again.

Thanks
Hemant

Re: Searching complete / for sudo

Pete Randall — Thu, 08 Jun 2006 13:30:01 GMT

You said you generated a list of the 414874 files that need to be searched. Use that list:

for i in `cat my_file_list`
do
grep -i 'sudo' $i
done

Pete

Re: Searching complete / for sudo

Hemant S. — Thu, 08 Jun 2006 13:41:30 GMT

Hi Pete

I have also tried to use a similar script but it hangs when is goes for a file like this - And I am tired killing those infinite greps.
prw------- 1 root root 0 Jul 30 2003 /etc/opt/resmon/pipe/1573980217

And some other files with names FIFO in it.

So I am looking for some script where it should search a file in this listing and go for next $i WITHOUT any wait period and if it hangs anywhere, ONLY then it should wait for 30 seconds and then kill the grep for that $i if it is still hanging and then proceed to search on next file in listing.

I am using - grep -l sudo $i > /tmp/result.out. As if any file has sudo word in it will be written to this result.out.

Any help is really appreciated.

Thanks
Hemant

Re: Searching complete / for sudo

Christian Tremblay — Thu, 08 Jun 2006 13:41:55 GMT

it's important that you use the -type f switch to the find command to look only at regular files not at a named pipe where you say it hangs.

Re: Searching complete / for sudo

Peter Nikitka — Thu, 08 Jun 2006 14:31:43 GMT

Hi,

to exclude pipes, sockets, directories and not querying symlinks, use
find / -local -type f -print | xargs fgrep -l sudo >/tmp/result

I don't know if HPUX-find has '-local' option (have no HP at hand now) to inhibit walking into NFS-mounts, but there may be an option '! -fstype nfs' or so as a substitute.

mfG Peter

Re: Searching complete / for sudo

spex — Thu, 08 Jun 2006 14:58:21 GMT

This works on my system, and makes doubly sure that only text files are grep'ed:

find / -type f -local -exec file {} \; | awk -F ':' '/text$/{print $1}' | xargs grep -l 'sudo'

If you already have a list of files, replace everything before the first pipe with 'cat filelist'.

PCS

Re: Searching complete / for sudo

Hemant S. — Fri, 09 Jun 2006 09:41:28 GMT

Thanks for your help Christian.
- Hemant