Access permissions changed on ping command

[Sayed Suhail]

Hi all

I'm facing a funny situation on my HP9000 servers running HP-UX 10.20. I've noticed that after any one of my servers has been rebooted the file access permissions on the ping command change and the setuid is removed.

following are the permissions after a reboot

lr-sr-xr-t 1 root sys /etc/ping -> /usr/sbin
/ping
-rwxrwxr-x 1 bin bin /usr/sbin/ping
I believe that the actual permissions should be:

-rwsrwsr-x 1 root bin ping

Have any of you faced such a problem. I would highly appreciate any suggestions you may have.

Thanks & Regards

Suhail

[Paula J Frazer-Campbell]

Hi
I have checked ping on two 10.20 servers and ping should be:-

in /etc

lr-sr-xr-t 1 root sys 14 Jun 10 1996 ping -> /usr/sbin/ping

and /usr/sbin

-r-sr-xr-x 1 root bin 24576 Jun 10 1996 usr/sbin/ping

1. Check the date on files.
2. Check for security breaches as ping is a very useful tool for hackers.
3. Disable use of ping until you identify what has changed it.

HTH

Paula

[Wieslaw Krajewski]

Hi,

It is difficult to answer what has happened, that file permission to /usr/sbin/ping are changed.

But I'd like to recommend the following to check if something has changed:

swlist -a mode -a size -a cksum -l file |
grep /usr/sbin/ping

The above command scans the Installed Product Database listing file permissions, size and control sum.
without grep for all files, with grep only for the specified file (/usr/sbin/ping in the example).
Then you can check permissions directly and other two attributes by

cksum /usr/sbin/ping

Then comparing these values you can find if sth has changed.

As concerns /etc/ping it is just a transition link to make compatibility with pre HP-UX10 versions. All these transition links can be removed by tlremove in any time, if you think that it could be insecure preserving them, But I don't think so.

Hope this helps.

Rgds.