strange file on /tcb/files/auth/?/

[Patricia Cordeiro]

Hi,

We had a problem with a user on a trusted system, when the user (wich is used constantly by an application) suddenly began taking too much time to log in, causing the application to fail. It happened in the middle of the night, and nothing had been changed.

I found out that there was an empty file on /tcb/files/auth/c/ with almost the same name as this user, but with a "-t" on the end, and without any permissions. The time of this file was the same as the application began to fail. Removing this file restored everything to normal.

Does anyone have a clue to why this file was created? I tested creating a file with the extension '-t' for other users, and it has the same effect slowing down the login time.

Best regards,
Patricia.

[Bill Hassell]

I don't of any automatic way that would create the bogus file, but it would require root in order to do it. That narrows the choices considerably. Try a grep through root's shell history file to see if there is an 'oops' logged in that file. Look at time stamps in syslog and also in cron -- there may be a failing script running at that time that creates the bogus file.

[Darren Prior · Accepted solution]

Hi Patricia,

The file ending in -t is a lock file, which should be removed after the command using it has successfully completed. Perhaps a modprpw or passwd command had been run on that user and it failed to complete?

regards,

Darren.

[Patricia Cordeiro]

Hi,

Unfortunatelly, by the time I found the file, several commands had been executed by another analyst trying to solve the problem, so the history file did not have any usefull information.

But knowing that it is a lock file used by commands such as passwd or modprpw is helpful, we will look into it, as if there are any scripts using these commands on the application. Anyway, it will make it easier to figure it out if it ever happen again.

Thanks,
Patricia.