topic Re: security question in Operating System - HP-UX

security question

james gould — Thu, 27 Jun 2002 15:44:08 GMT

When doing a whoami command as a regular user
the following message appears :
Intruder alert

Does not happen when running the same command
as root.

O/S is 11.00

Re: security question

Giri Sekar. — Thu, 27 Jun 2002 16:04:47 GMT

whoami reads the /etc/passwd file for info. check the permissions and if it is not readable for users then you would get this message. Does not happen for root 'coz root will have the permissions on it.

Re: security question

James R. Ferguson — Thu, 27 Jun 2002 16:05:56 GMT

Hi James:

Make sure /etc/passwd is readable by everyone:

-r--r--r--

Regards!

...JRF...

Re: security question

james gould — Thu, 27 Jun 2002 16:13:52 GMT

Permissions are open for read only on both
passwd and group files.

When running a password check if anything is
wrong in the file could that cause this error
to appear??

Re: security question

MANOJ SRIVASTAVA — Thu, 27 Jun 2002 16:15:37 GMT

the permissions of /etc/passwd fuile are r-- --- --- change it to r-- r-- r-- and you are good to go.

Manoj Srivastava

Re: security question

Giri Sekar. — Thu, 27 Jun 2002 16:17:16 GMT

The decision would be yours. If you make the /etc/passwd file as 444 then you will not get this error. But you may have turned it off for security.

Re: security question

MANOJ SRIVASTAVA — Thu, 27 Jun 2002 16:18:41 GMT

Also James
check whether there are two or more user having the same user id this wil also cause whoami to give intruder alert.

Manoj Srivastava

Re: security question

James R. Ferguson — Thu, 27 Jun 2002 16:22:36 GMT

Hi (again) James:

Make sure the permissions of '/etc' (and '/') allow read and execute to everyone, too. Do:

# ls -ld /
# ls -ld /etc

Regards!

..JRF...

Re: security question

Rob Fisher — Thu, 27 Jun 2002 16:30:54 GMT

I have permissions -rw-r--r-- on most of my servers. If you set these permissions make sure that the owner is root and the group is root.

Good luck

Re: security question

brian_31 — Thu, 27 Jun 2002 16:49:32 GMT

Hi James:

Did you get a chance to look into your profile??? 3/125(points alloted). If you feel all the above answers are dumb then put N/A.

Thanks
Brian.

Re: security question

james gould — Thu, 27 Jun 2002 16:49:56 GMT

All permissions are ok

Will try restoring passwd file from backup and
see if that does the trick

Re: security question

Jerry Anderson_1 — Fri, 28 Jun 2002 18:49:33 GMT

According to what I read online (Google search) this message has nothing to do with file permissions.

If the current user ID is not in the password file, the message Intruder alert is displayed.

I'm not sure under what circumstances you could end up with a UID that is not in the password file, but that appears to be the case here.

Re: security question

james gould — Fri, 28 Jun 2002 18:55:07 GMT

Restored a backup of the passwd file and it
fixed the problem. Seems that another admin
modifed a user password so they could not login
and deleted the UID by mistake.