/dev/pts/tk possibly causing corrupution in /dev/utmp

[John Dixon_5]

We have an application that is misreporting the username (vendor says it uses whoami, but whoami reports correctly even when the application is wrong). The misreporting seems to be tied to the /dev/pts/tk device. I am willing to remove this if it is ok or possibly even remove and then rebuild it. This is a little deeper than the knowledge I have and I'm unsure whether I might be treading on thin ice. Any help would be appreciated.

[Kent Ostby]

Well there shouldn't be any issue with /dev/pts/tk since its just like any other /dev/pts/t? file.

What is leading you to this conclusion ?

What is the OS revision and what is the product in question ?

Oz

[John Dixon_5]

OS is HP/UX 11.11. It (tk) looked the same as the rest of the files (#, t*), but every instance where the user was misreported in Unidata (the database application which the application is built on and the one doing the misreporting) was from this port. The user it is reporting as being is not a unix user anymore. Totally baffled as to what is causing this. Thanks!

[Kent Ostby]

Have you checked to see what process is using that pty ? If that's the only pty that unidata uses then it is just an innocent victim in all of this.

What user ID is it reporting ?

Has that user ID been removed since unidata was started ? It may be that unidata is cacheing the user data ?

[Jeff Schussele]

Hi John,

This is probably a symptom of the telnetd daemon binary needing to be patched.
I can't remember the exact patch name but if you search the forum for
telnetd + utmpx corruption
you should find an old post on it. But NOTE that you have to follow the patch's special instructions for it to work correctly.

HTH,
Jeff

[Jeff Schussele]

Found it - here it is PHNE_28841:

http://www2.itrc.hp.com/service/patch/patchDetail.do?BC=patch.breadcrumb.main|patch.breadcrumb.search|&patchid=PHNE_28841&context=hpux:800:11:11

And here's the salient problem entry:

SR 8606220839 / CR JAGad89975
3. Incorrect records might be written into /etc/utmpx
by telnetd when it exits.

Check to see if you have it & if not get & apply it. Again NOTE and follow the special instructions.

HTH,
Jeff