/etc/passwd gone!!!!

[Alan Garner]

Had a little panic today! For reasons yet to be determined, I notice "savemail panic" noticed where being thrown up on the console, one right after another. Since the server was not in production, I decided to reboot to try and clear the panic. BAD MISTAKE!

The system comes up and begins to complain about no root user exists...! WHAT! I imediately got on the phone with HP. After getting to the shell in single user mode, we figured out that the /etc/passwd, /etc/shadow, and /etc/group fils were missing! This system has only been up for a week and I had not yet put our backup client on there! Luckily, we were able to recover the default files from the /usr/newconfig/etc folder. I only need to recreate one user and two groups.

HOWEVER, now there are a few things I have noticed that don't work anymore. First, my beloved Sytem Management Homepage can not be started. Next, we had ssh enabled and telnet disabled...that is now switched.

1) How do I get these things back to the way I had it, SMH working, SSH enabled, and telnet disabled?

and...

2) What else should I look for that may be broken now that the files had to be reverted back to defaults?

Thanks for all you guru's out there for helping me in the past...it sucks being a newbie! Hope I sound clear and you can offer some advice!

[Torsten.]

I have never seen this happen by itself ;-)

I assume somebody was root and gave some commands a try. You have to reverse all steps. To be safe, I would consider to install the system again.

[Alan Garner]

Me niether! No one except me was in the system at the time...I know because I had not yet given out the user info. Not sure what I did though. The syslog only show the last reboot and I don't know where else to look!

Cold install not really ideal at this point because this would push our project schedule back a week or two while I reconfigure! But if I must...then relunctantly I will. Unfortunately, re-imaging is not possible since this is the only HPUX server we have thus far!

I just can't figure out what I did. Maybe I'll use this as a push to get auditing software that can capture sessions!!!

Thanks...keep em coming!

[skt_skt]

I would suggest to reinstall as you are not sure what else is missing. You dont have any more servers to comapare with.

being a new server, you will be in a position to try it even reluctantly. But yo cant do that later.

You may have trouble later unless you make sure what all are really missing.

this entry controls the telnetd

grep telnet /etc/services
telnet 23/tcp # Virtual Terminal Protocol

alo you may reinstall the ssh software.

[Dennis Handly]

>Santhosh: I would suggest to reinstall as you are not sure what else is missing.

You could use swverify to check to see what's missing. But this may not check the config files in /etc/ or /var/.

[Eric Jacklin]

You can chose ignite as the last avialable option

[Marcel Burggraeve]

I would suggest to reinstall as well.
Since you're not sure what has happened to the system and have no system to compare with you cannot be 100% sure it's just those files you mentioned that are missing.

You have to ask yourself the question what's worse to happen :
1) being set back one or two weeks and end up with a stable system.
2) try to repare what you have, take the system in production and find out there's more hidden problems.

[Alan Garner]

Thanks for the advice. One more thing. In my original post, I said that I had not yet put the backup clinet on the machine yet. I was mistaken...I had indeed put the client on there and was troubleshooting the backup procedure. Could this have caused this to happen. We're using NetBackup v5.1. We've contacted Symantec to see if there are any known issues or if this version is compatible with HP-UX v3.

Thanks again. I'll wait for responses today then make my case to the powers that be this afternoon.

[Srinivas Thokala_1]

For backing up the os, you need to ensure Ignite-UX is installed. Then use make_tape-recovery or make_net-recovery for backing up the OS.

Try rebuilding your group and passwd files
initially for the important users and you can build it completely at later.

Under /etc directory search for any old passwd and group files, if not get the default files from HP CDs and get the users info from the available home directories on the system and add them with commands:

#groupadd -g gid
#useradd -u uid -g gid -m -s /usr/bin/ksh -c "details of the user"

Srinivas

[Alan Garner]

Ignite is installed but it does me no good without another HP-UX system to archive it to...at least that is the way I understnd Ignite.

Once I get more systems in then I will be using ignite! Going to have HP analize my log files. Boss want to know exactly what happens before we go rebuilding so we don't make the same mistaskes. Thanks to all who helped. I am closing this as it seems the only safe bet is to re-install!

[Alan Garner]

Thanks again!

[Marcel Burggraeve]

I would really suggest to read up on Ignite since it can archive to tape as well and with some more effort you can even burn CD/DVD media.
No need at all to have a second HP-UX system to make good use of Ignite.

Hmm, just checked http://docs.hp.com/en/IUX/overview.html and if someone is unfamiliar with Ignite I can understand one might think you actually need more system to make good use of it.
make_tape_recovery is being mentioned but it's at the bottom of the page.