topic Re: Missing identd in Operating System - HP-UX

Missing identd

David Craft — Wed, 12 Jun 2002 00:54:23 GMT

Something very odd turned up on my server today. All of a sudden, identd seems to be missing on my HP-UX 11.0 server. Ideas on why this would happen, how to recover and get another copy? I'd prefer to see if there is a way to get this off the O.S. CD without a reinstall or get a copy from a safe place.
Thanks,
Dave

Re: Missing identd

harry d brown jr — Wed, 12 Jun 2002 00:57:45 GMT

david,

Things just don't disappear. Someone, or some process (more likely) removed it. I'd focus on finding that process, then restoring it.

live free or die
harry

Re: Missing identd

David Craft — Wed, 12 Jun 2002 01:15:17 GMT

I most heartily agree with that. I have been trying to track this down and will find out eventually. The real problem is this leaves the system without a way to identify ftp and other sessions to the logger which is a VERY big concern. Right now my chief concern is getting the identd back as easily as possible. I have already been looking at who has been on, etc., to try and track down the culprit and how they were able to get rid of it. I have a feeling it is some application code but haven't been able to pin it down yet as it is buried in a 3rd party script.

Thanks,
Dave

Re: Missing identd

Michael Tully — Wed, 12 Jun 2002 01:19:28 GMT

Hi Dave,

The 'identd' binary resides in '/usr/lbin/indentd'

Do you have it on another server, backup tape or ignite tape?

Files just don't get removed without some sort of intervention. Was there a new 'cron' job
introduced to do system cleaning? Any security
related issues??

Anyway you can't just copy it from the CD, you would need to install the patch or fileset that it came with. On my install CD (March 2001) it comes as part of patch PHNE_17190. I suggest if you can't get it from backup tape, look at installing from a patch.

Cheers
~Michael~

Re: Missing identd

David Craft — Wed, 12 Jun 2002 01:28:23 GMT

Thanks Michael, I will try to install it from a patch. I agree things don't just "disapear" from a system. I am watching a third party app that appears to be using identd to try and verify web users. I am looking very closely at this right now to see if the app is what made it disapear. If so, bye bye app until that puppy is fixed!!

Thanks