chmod 777 entire filesystem

[Jeroen_D]

Hi,

someone of our customers has done a chmod 777 of his entire filesystem... well... I guess it is better than doing a 444 on everything but still... :]

This is one of the errors that now occur : when you are a normal user and you type "su - root", you can type the root's password but then it says : su: Invalid ID.

I suppose HP-UX is checking something ? How can I get that command to work ?

I know that the HP-UX security has been blown to bits but for the few users on this station it doesn't really matter who has access or not... but it appears to me that it DOES matter for the OS itself. Can anyone confirm this to me ? Because if it so, I will have to put back the rights to every file (or at least those containing configs) by hand or by a full restore of the system. Of course I would like to avoid the latter...

Any info is welcome,
TIA,
Jeroen.

[Victor_5]

When you issue 'su - root', system will use the temporary environment and permissions of root, it still need to check /etc/passwd, so check this file for your uid info.

[John Bolene]

He has reset the setuid and sticky bits, and all the normal permissions.

Bunch of work to get back each file to original.

I would do a system restore.

They most likely already know not to do that again.

[Santosh Nair_1]

Jeroen,

I hate to say this, but I think you have no choice but to restore from backup. There are far too many files that need to be changed.

There are several commands that need the suid bit set, this includes su, login..in fact, doing a find in /usr/bin for progs with suid set produces this list:

/usr/bin/mediainit
/usr/bin/bdf
/usr/bin/rcp
/usr/bin/remsh
/usr/bin/at
/usr/bin/crontab
/usr/bin/mail
/usr/bin/rmail
/usr/bin/newgrp
/usr/bin/nfsstat
/usr/bin/chkey
/usr/bin/chfn
/usr/bin/df
/usr/bin/login
/usr/bin/su
/usr/bin/chsh
/usr/bin/nispasswd
/usr/bin/passwd
/usr/bin/yppasswd
/usr/bin/pppd
/usr/bin/rdist
/usr/bin/rexec
/usr/bin/rlogin
/usr/bin/uucp
/usr/bin/uuls
/usr/bin/uuname
/usr/bin/uusnap
/usr/bin/uustat
/usr/bin/uux
/usr/bin/ct
/usr/bin/cu
/usr/bin/kermit
/usr/bin/cancel
/usr/bin/disable
/usr/bin/enable
/usr/bin/lp
/usr/bin/lpalt
/usr/bin/lpstat
/usr/bin/slp
/usr/bin/X11/hpterm
/usr/bin/X11/xterm

And that was only on /usr/bin and only checking for suid, you'd have to check in /usr/sbin, /usr/lbin, /sbin, etc and you'd have to check for sgid programs too.

Hope this helps.

-Santosh

[Andreas Voss]

Hi,

to reconstruct the most files and directotries use this script:

#!/sbin/sh
find /var/adm/sw/products -name INFO -exec cat {} \; |
awk '{
if($1 == "path") path=$2;
if($1 == "mode" && path ~ "^/") printf("chmod %s %s\n",$2, path);
}' | sort -u >perm_reset.sh

After this script has finished it has created a new script called perm_reset.sh

Run the perm_reset.sh to set things right.

Good luck

[James R. Ferguson]

Hi Jeroen:

Andreas Voss provided an elegant script to address this problem once before. See his post (with the script attached) here:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,1150,0xa7ef6c96588ad4118fef0090279cd0f9,00.html

Regards!

...JRF...

[Sachin Patel]

Hi Jeroen,
I did it same thing. I thought I am in my home while I was in /. Pain in ...
Easy solution is to restore OS.


Sachin

[Jeroen_D]

Andreas,

that script looks really nice and I was about to give you a 10/10 when I noticed it checks the /var... and damned... that customer still has the old HP-UX 9.05 running.

You wouldn't happen to have another script that would prevent me of doing a full system restore ?

Jeroen.

[Andreas Voss · Accepted solution]

Hi,

oooh these old days ...

I had a look at my HP9000/433s (HP-UX 8.0)
and have found that in /system/... there are files named pdf which contain information of installed files.
I put you a script at attachment.
Hope this works also under HP-UX 9.x

Regards

[Jeroen_D]

Thanks a lot Andreas !!!

Your script rocked and now the system is back up and running as it should.

Tnx again ! You deserved the 10/10.
Jeroen.