topic Re: username not shown in ps -ef output in Operating System - HP-UX

username not shown in ps -ef output

NDO — Sun, 21 Feb 2010 13:00:13 GMT

hi all!

Please can some help on this one.
Somebody must have changed something, what is happening is that when "ps -ef" it does not show the owner of the process, it onlys shows the the user ID,which is a problem for us because we have an application that has its own user to start it up. Please can somebody help?

Fernando

Re: username not shown in ps -ef output

James R. Ferguson — Sun, 21 Feb 2010 13:37:12 GMT

Hi Fernando:

> it does not show the owner of the process, it only shows the the user ID,

This suggests that either (1) the user (account) has been deleted from the system after the process was started; or (2) the permissions of '/etc/passwd' are not world-readable.

Verify your '/etc/passwd' file contains an entry for the 'uid' associated with the process and that the file is world-readable.

Regards!

...JRF...

Re: username not shown in ps -ef output

NDO — Sun, 21 Feb 2010 15:06:21 GMT

Hi!

Unfortuately its not only processes owned by a particular user that are not shown in the ps -ef. Even processes owned by root or any user, look below at one listing:
mpecu007[344] / # ps -ef | more
23y0C UID PID PPID C STIME TTY TIME
COMMAND
0 0 0 0 Jan 19 ? 140:15 swapper
0 1 0 0 Jan 19 ? 4:40 init
0 2 0 0 Jan 19 ? 164:01 vhand
0 3 0 0 Jan 19 ? 1893:44 statdaemon
0 4 0 0 Jan 19 ? 9:17 unhashdaemon
0 8 0 0 Jan 19 ? 352:41 supsched
0 9 0 0 Jan 19 ? 0:00 strmem
0 10 0 0 Jan 19 ? 0:00 strweld
0 11 0 0 Jan 19 ? 0:00 strfreebd
0 12 0 0 Jan 19 ? 0:12 ttisr
0 18 0 0 Jan 19 ? 97:44 lvmkd
0 19 0 0 Jan 19 ? 99:28 lvmkd
0 20 0 0 Jan 19 ? 92:07 lvmkd
0 21 0 0 Jan 19 ? 96:19 lvmkd
0 22 0 0 Jan 19 ? 87:41 lvmkd
0 23 0 0 Jan 19 ? 94:18 lvmkd
0 24 0 0 Jan 19 ? 0:00 lvmschedd
305 27349 27347 0 Jan 29 pts/0 0:00 /csh_ceexec
305 27965 1 0 May 5 ? 0:00 /usr/dt/bin/dtexec -open 0 -ttpr
ocid 2.1A06oT 01 27938 13421
0 29 0 0 Jan 19 ? 933:24 vxfsd
305 331 1 0 Apr 29 ? 0:00 /usr/dt/bin/dtterm

Any hints in what could be wrong?

Fernando

Re: username not shown in ps -ef output

James R. Ferguson — Sun, 21 Feb 2010 15:33:40 GMT

Hi (again) Fernando:

Verify that your '/etc/passwd' hasn't been truncated (to a size of zero).

Regards!

...JRF...

Re: username not shown in ps -ef output

NDO — Sun, 21 Feb 2010 15:43:11 GMT

Ok, I'll check that, I'm already at home now, and I do not have access from home, I'll let you know tomorrow

Regards

Fernando

Re: username not shown in ps -ef output

Bill Hassell — Sun, 21 Feb 2010 17:55:59 GMT

user names are stored in only one place: /etc/passwd. For programs like ps and ll, the user ID (number) is translated to a user name for convenience. The UID number is still the same and processes should run correctly unless there is code that relies on the translated user name. Since /etc/passwd contains the user names, someone may have tried to "improve" security by taking away read permission for /etc/passwd. Or worse, the file has been corrupted with bad editing. As soon as possible open a couple of root logins as asses the damage.

Re: username not shown in ps -ef output

Dennis Handly — Sun, 21 Feb 2010 20:48:22 GMT

Are you using NIS? If so, then a failure there would suppress those UIDs. But it seems that root is also suppressed. So your passwd file is bad. Is pwgrd(1M) running?
What OS version are you running?

Re: username not shown in ps -ef output

Kapil Jha — Mon, 22 Feb 2010 01:53:40 GMT

Ur ps -ef output shows numbers (0,30..) in UID colums that means its showing uid not username.

What does ps -elf shows.

and yes check passwd file if its intact.

Better u don't log out a root session.

BR,
Kapil+

Re: username not shown in ps -ef output

NDO — Mon, 22 Feb 2010 07:24:21 GMT

hi the passwd file has size 854, it looks ok, but if I type whoami at prompt it shows Intruder alert. I will be posting the passwd file soon. Fernandi

Re: username not shown in ps -ef output

Kapil Jha — Mon, 22 Feb 2010 07:29:06 GMT

don post passwd file if it has encrypted passwd :)

what does id command shows.

BR,
Kapil+

Re: username not shown in ps -ef output

johnsonpk — Mon, 22 Feb 2010 07:33:33 GMT

Check the integrity of passwd file by running pwck

Also post the permission of /etc/passwd and contents of /etc/nsswitch.conf file

Re: username not shown in ps -ef output

NDO — Mon, 22 Feb 2010 08:22:19 GMT

Hi, All

For some reason everthing is back to normal, that is before I run the pwck comand which the output is:mpecu007[389] /tmp # pwck > /tmp/pwck.out

smbnull:*:101:101:DO NOT USE OR DELETE - needed by Samba:/home/smbnull:/sbin/sh
Login directory not found

postgres:*:378:20:PostgresSQL,,,:/usr/local/pgsql:/usr/bin/sh
Login directory not found
.........................................

The paswwd file is not encrypted, please find attached the file.

But I'm a bit nervous because now everthing is fine, ps -ef it does show the username, and the whoami comand shows me root.
Please can you give me some hints.

Fernando

Re: username not shown in ps -ef output

Dennis Handly — Mon, 22 Feb 2010 09:06:38 GMT

>the whoami com and shows me root.

Did you su from root?

Re: username not shown in ps -ef output

NDO — Mon, 22 Feb 2010 11:17:45 GMT

Yes, I was root.

Fernando

Re: username not shown in ps -ef output

James R. Ferguson — Mon, 22 Feb 2010 12:57:32 GMT

Hi (again):

You have yet to verify that the permissions of your '/etc/passwd' file are "-r--r--r--".

Regards!

...JRF...

Re: username not shown in ps -ef output

NDO — Mon, 22 Feb 2010 16:55:37 GMT

Hi all!

Thank you very for your contributions, I appreciate your help, but now I'm gonna have to close this thread and assign some points to all you.

Thank you

Bye

Fernando

Re: username not shown in ps -ef output

NDO — Mon, 22 Feb 2010 16:59:21 GMT

thank you all

Fernando

Re: username not shown in ps -ef output

James R. Ferguson — Mon, 22 Feb 2010 16:59:38 GMT

Hi (again) Fernando:

> but now I'm gonna have to close this thread and assign some points to all you.

That's very nice, but more importantly exactly *what* caused your problem?

Regards!

...JRF...