topic Re: make_recovery changes modification date of /etc/passwd and /etc/group in Operating System - HP-UX

make_recovery changes modification date of /etc/passwd and /etc/group

Mark van Hassel — Mon, 07 Jan 2002 14:20:09 GMT

Hi,

Out of curiosity:
Does anyone know why make_recovery changes the timestamps of /etc/passwd and /etc/group files.
Is there a special reason for this ?

I noticed this because we keep track of changes to important system files and every time a make_recovery runs the time stamp of the passwd and group files changed.

Thanks,

Mark

Re: make_recovery changes modification date of /etc/passwd and /etc/group

Craig Rants — Mon, 07 Jan 2002 14:29:16 GMT

Mark,
The mtime changes because ignite moves the inode of every file it backs up. I have found that some IDS systems will generate alerts when ignite is running. Just something that you will have to live with when running this type of backup.

Hope this explains things,
C

Re: make_recovery changes modification date of /etc/passwd and /etc/group

Darrell Allen — Mon, 07 Jan 2002 14:37:53 GMT

Hi Mark,

That's interesting. It doesn't happen on my 11.0 systems. Are you using the latest Ignite? I'm running:
# swlist -l product | grep -i ignite
Ignite-UX B.3.3.116 HP-UX System Installation Services
# swlist -l bundle | grep -i ignite
B5725AA B.2.2.157 HP-UX Installation Utilities (Ignite-UX)

You may want to start using make_tape_recovery also.

Darrell

Re: make_recovery changes modification date of /etc/passwd and /etc/group

James R. Ferguson — Mon, 07 Jan 2002 14:38:11 GMT

Hi Mark:

If I recall correctly, Ignite version 3.4 and above fixes this problem by *not* restoring the last access timestamp (atime) of files and thereby leaving the inode change timestamp (ctime) unchanged.

Regards!

...JRF...

Re: make_recovery changes modification date of /etc/passwd and /etc/group

James R. Ferguson — Mon, 07 Jan 2002 14:45:40 GMT

Hi (again) Mark:

My memory is semi-intact. This was corrected in Ignite 3.3. From the Ignite site"

http://www.software.hp.com/products/IUX/news.html

/bein_quote/

File mtime, ctime, and atime behaviors have changed in the recovery commands. make_tape_recovery, make_net_recovery, make_recovery, and make_sys_image no longer use the -t option to the pax command. This
option was being used so that the "atime" (access modification time) of the the files being backed up were restored. However a hidden side effect of this -t option was that it caused the the "ctime" (inode modification time) of files being backed up to change. The ctime change triggers tools that do security checks to raise an alarm. Another side effect of the -t option also caused the mtime modification time) of /etc/passwd and /etc/group to be changed due to the way make_recovery used -t in combination with the -s pax option.

/end_quote/

Regards!

...JRF...

Re: make_recovery changes modification date of /etc/passwd and /etc/group

Craig Rants — Mon, 07 Jan 2002 14:55:33 GMT

Well, I already learned something today, I did not know that they had fixed this in the newer releases.

C

Re: make_recovery changes modification date of /etc/passwd and /etc/group

Mark van Hassel — Mon, 07 Jan 2002 15:36:17 GMT

Thanks for the quick responses. We have indeed an older version of Ignite running.