Error "No utmp entry, must login from lowest level shell?"

[Vinod Tandon]

Platform: HP-UX 11.11
--
I changed username and password. Now when we login using this user account it gives error "No utmp entry, must login from lowest level shell?" and the session terminates.
--
Please let me know how to fix this if anybody has knowledge about this,
Thanks in advance.

[A. Clay Stephenson]

You have corrupted the utmp file.

cp /dev/null /etc/utmp

That should fix you although who will no longer return valid data but that's ok because at best, who, is a guess anyway.

[Dennis Handly]

>Clay: cp /dev/null /etc/utmp

Do you really want to use cp and change permissions, ownership, etc?
What about: > /etc/utmp

[Vinod Tandon]

Just want to confirm - Will it be safe to do "cp /dev/null /etc/utmp"
--
Please note that we do not want to restart the server.
Thanks for your help.

[A. Clay Stephenson]

Yes, it is safe. cp /dev/null /etc/utmp will even preserve the mode of the file if /etc/utmp already exists but you can check it afterwards. The mode rw-r--r-- (644) and owned by root:root. The downside to this is that utilities like who that rely upon utmp's validity will no long have valid data --- but who should never be trusted anyway.

[Jeff Miller - 1]

I always monitor this file on a daily basis since I work for a company that requires HIPPA compliance. Thus I have always been able to restore this file from the previous nights backup. If you're not monitoring this file on a daily basis, you may have to go back a way until you find a good file. However, since you said that this just happened, you may want to check your backups...

[Vinod Tandon]

Thank you guys for your response. My problem is fixed now.

[A. Clay Stephenson]

Well, you can always use fwtmp to read the file out in ascii, patch it with an editor, and use fwtmp again to write it back in binary BUT I consider that a waste of time and I also consider utmp as any sort of measure for SOX or HIPPA compliance to be a far less than reliable standard. Remember, at best, this file is a best guess as it any output from the file. Moreover, if you restore from backup you have already discarded data -- you've only hidden your tracks better.