/etc/passwd file

[Pelephone System]

Hi all.

Do someone know if there is a utility or
any script that is checking the validity
of passwd file.

When I'm login into specific host in my site
I'm getting a message - "Intruder Alert" ?

Is it because of corruption of passwd file?

[Con O'Kelly · Accepted solution]

Hi

Have a look at pwck, grpck & authck commands.
3rd party utilities such as Tripwire are alos useful.

Look through the passwd file & check for any new entries that maybe shouldn't be there, entries (apart from root) with UID 0, entries with no passwd etc.

The message is not from a corrupted passwd file, more likely from software that is running on your system or any of the files that are parsed at login.

Cheers
Con

[Steven E. Protter]

pwck
grpchk

Do this though.

bdf /

If root fs is 100% here is what happened:

The root fileystem is full and the /etc/passwd or /etc/group file is zero bytes.

You need to immediately clear space on the root filesystem and probably restore /etc/group and /etc/passwd from a very recent backup.

Common causes of root fs being full:

files copied accidently to where the tape drivers are: /dev/rmt/ directory is a common place where stuff piles up from bad cpio commands.

If you are lucky, there is a big file in the / at the top that you can delete to releive the pressure.

I actually keep a 100 MB file sitting there that I can get rid of in a pinch while I figure out what the heck went wrong.

Other things to think about:

1) Files copied in a mounted subdirectory are invisible when the fs is mounted on them. For example, with /usr not mounted, I copy a 200 MB file into /usr Then I type mount /usr

The file is still there, taking up space and it can't be seen. A good way to find these guys is to boot into single user mode.

The intruder alert message is the first error message I got as a Sysadmin.

SEP

[Michael Tully]

There are perhaps four things that this could be:

The password file is corrupted, so you could run something like 'pwck'
The password file has incorrect permissions, they should be set to 444
The wrong NIS domainname is set
/var/is full

[Zigor Buruaga]

Hi,

Do you have trusted system?
Does your /etc/passwd file read permissions for
everybody?

If the user has no read permissions in passwd file, check in the profile if there are something like:
PS1="`hostname`.`whoami` $ "

The previous line could cause an "Intruder Alert" if the user has no read permissions in /etc/passwd. Only an idea ...
Hope this helps.

Regards,
Zigor

[Sunil Sharma_1]

Hi,


pwck and grpck is the command to check integrity of passwd and group file.

Sunil

[Rainer von Bongartz]

Intruder alert usually comes from wron permissions on /etc/passwd

check if the permission is 444

Regards
Rainer

[yogesh_4]

The Consistency of /etc/passwd file can be check with "pwck" command and consistem=ncy of group file can be check with "grpck" command.

[Zeev Schultz]

eitan it looks like you're using
intrusion detection system (like hp ids/9000).
Scroll your syslog.log,look for boot time informative messages from software packages (eTrust,IDS/9000 ,zeos ...etc).As to password file - you can switch (for test purposes) to NIS (ldap,whatever) (/etc/nsswitch.conf) + changes in /etc/pam.conf (if ldap) and try to use different authentication method than /etc/passwd.

Zeev

[Jeff Arthur]

I know its an old thread, and you have already been fixed, but for anyone else that wanders along.

I saw this problem when nsswitch.conf was configured to use nis for passwd and group resolution, but nis was unavailaible (during an HPUX upgrade.

To fix it I set it to
passwd: hosts
group: hosts

good luck to you.