topic Re: /sbin/sh corruption in Operating System - HP-UX

/sbin/sh corruption

Joe White — Wed, 27 Feb 2002 19:33:01 GMT

Hi,
I have an HP E class running 10.20 which has experienced corruption of /sbin/sh. There's no indication that anything has changed (date, ownership or chksum) yet when attempting to login at the console or telnet as root we receive 'no shell'. The console starts scrolling with the typical getty errors since a respawn of the console isn't possible. Once we provide a 'new' copy of the shell all is back to normal. Anyone have any ideas?

Re: /sbin/sh corruption

Patrick Wallek — Wed, 27 Feb 2002 19:43:18 GMT

I would start by comparing the good and the bad versions of /sbin/sh.

Try things like 'file', 'what', 'strings', etc. to see if anything is different. Had you installed any patches or anything recently that could have caused this?

Re: /sbin/sh corruption

A. Clay Stephenson — Wed, 27 Feb 2002 19:53:27 GMT

Hi Joe:

My first question is where are you getting your new copy. Bear in mind that you must have a version from /sbin that is staically linked. The one in /usr/bin won't work. If this is a recurring problem, some process must be copying to /sbin/sh, perhaps an arrant script with stdout redirected to /sbin/sh. In any event, you need to hunt this down quickly.
Patrick's idea is sound. I wouls save a copy of the bad version and examine it with every tool I could find. In addition to those mentioned, I would add od -c /sbin/sh | pg.

Re: /sbin/sh corruption

Eric Ladner — Wed, 27 Feb 2002 20:01:54 GMT

Did 10.20 still use the /etc/shells file? Check that also. If I remember correctly, the users login shell had to be in that file. If it was deleted, I'm not sure what login would do.

I know 11.x doesn't use the shells file any more.

Re: /sbin/sh corruption

Darrell Allen — Wed, 27 Feb 2002 20:16:13 GMT

Hi Joe,

So, does it appear /sbin/sh wasn't actually changed? The date / time stamp, size, and checksum didn't change?

When you say you provide a 'new' copy of the shell, do you mean you copy a shell to /sbin/sh or do you mean you enter the "sh" command?

Could the /etc/passwd entry for root's shell be bungled?

I don't believe /etc/shells would cause a problem for logging in. It would for ftp access.

Darrell

Re: /sbin/sh corruption

Joe White — Wed, 27 Feb 2002 20:48:34 GMT

sorry, should have provided more information.
The copy is /sbin/sh from another 10.20 machine. After moving the copied one into place logins are possible again.
/etc/passwd for root lists /sbin/sh as the default shell.
No new patches have been loaded recently, in fact, nothing has been added to the machine before or since this started. Basically it functions as a mailhost.

Re: /sbin/sh corruption

Kevin Wright — Wed, 27 Feb 2002 22:14:18 GMT

Well, like they said above, if this is a recuring problem something is writing to the shell and corrupting it..check all at and cron jobs for bad redirection.

Re: /sbin/sh corruption

Joe White — Mon, 04 Mar 2002 17:25:53 GMT

Doesn't appear to be a script problem. If it were, we'd see some kind of file change. Turns out we may have an inode table problem on /sbin. We've moved the 'corrupted' /sbin/sh to /tmp and 'sh' runs fine there.

Re: /sbin/sh corruption

Ben Roller — Mon, 04 Mar 2002 19:13:43 GMT

I too had this problem... I could not find anything out on the HP site... then I noticed it was happening during Netbackup backups.

I found this document that seems to have fixed the problem. You can find this on Veritas's knowledge base searching for "no shell".

Ben

Symptom:

The following error: /sbin/sh get message for root, is returned when trying to log on or telnet to a machine.

Exact Error Message:

/sbin/sh get message for root.

Solution:

This is an OnlineJFS problem.

The fix is to apply this patch from HP: PHKL_19530.
This patch has been replaced by patch PHKL_20356.
If this problem is encountered check to see if one of these patches have
been installed: PHKL_19530 or PHKL_20356.
If t, install the most recent HP patch that includes both of these patches.

--------------------------------------------------------------------------------
Tech te Summary:
Tech te Title: The following error: /sbin/sh get message for root, is returned when trying to log on or telnet to a machine.
Tech te ID: 231878
Last Updated: August 31 2001 05:59 PM GMT
This information in this Tech te applies to:
Products: NetBackup DataCenter 3.4, 3.4.1
NetBackup (UNIX Platforms) 3.1.1, 3.2

Subject: NetBackup DataCenter - Application - Compatibility
NetBackup DataCenter - Application - Informational
NetBackup DataCenter - Application - Patch
NetBackup v3.2 and prior (UNIX Platforms) - Application - Compatibility
NetBackup v3.2 and prior (UNIX Platforms) - Application - Informational
NetBackup v3.2 and prior (UNIX Platforms) - Application - Patch

Languages: English

Operating Systems: HP-UX 10.2