files owner turned to twj

[Burhan I. Koni]

dear all
i have a problem, i found my files' owner turned to twj(all my files owned by twj).
i need your help to understand what happened and how to go back to the normal situation.

Regards
Burhan Koni

[Peter Godron]

Burhan,
does the user twj exist on your machine: grep twj /etc/passwd

Did somebody remove your account and got SAM to reassign files to twj ?

These files are on your machine, not NFS mounted ? Otherwise it may be the local interpretation of the userid and groupid of the remote machine you are seeing.

To get back, establish what happened and either try to correct all the files by hand, or restore if you have a valid backup of the files.

[Geoff Wild]

How do you mean all?

Do you mean every file on the system?

someone as root may have executed a chown / -R twj *

You can get it back by:

find / -user twj -exec chown root {} \;

Rgds...Geoff

[James R. Ferguson]

Hi:

Only the owner of a file (or of course, 'root') can change the ownership with 'chown'.

Were your operating system files' ownership changed, as in '/usr'?

Regards!

...JRF...

[john korterman]

Hi,

if files suddenly change ownership to "twj", it might be a good idea to check the user "twj" in /etc/passwd.
Perhaps "twj" shares UID with the previous owner and "twj" has been physically inserted in /etc/passwd above the previous owner - this would change file ownership when executing ls -l



regards,
John K.

[Burhan I. Koni]

dear all
there is a user TWJ on the system but the UID is different from the UID of the user APPS11i see the comparison:
$ grep twj /etc/passwd
twj:1UE9nCOkwdNgE:104:20:,,,:/home/twj:/usr/bin/sh
$ grep apps11i /etc/passwd
apps11i:K.vgRRFdX4aR.:106:20:,,,:/home/apps11i:/usr/bin/sh

only the files owned by apps11i was changed to twj, and nobody know how this happened. the other files owned by other users stayed without change.

your help
Thanks
Burhan

[PVR]

root user can change the file permission by executing the command;

find / -user twj -exec chown twj {}\;

Seems to me that it happened by mistake from an admin.

[john korterman]

Hi again,

perhaps you should check some command history files for chown commands - particularly root and apps11i

regards,
John K.

[john korterman]

.. the command history file of tws, of course...

regards,
John K.

[V. Nyga]

Hi,

ask the administrator!

Also:
What system do you have?
Which os?
Do you have nfs directories, nis server?
Is this happen at a client?
Are the files locally stored?

Volkmar

[Peter Godron]

Burhan,
could it be that somebody changed the /etc/passwd file and swapped the uid of twj/apps11i ? I have tried this on my test machine and the ownership changes.

I mean, the uid and grpid stay the same on the file, but the lookup in /etc/passwd changes. ls -n would show you the numeric ids.

If you have a backup check whether the /etc/passwd file was changed, or the files were re-assigned to twj.

You haven't confirmed my earlier mail's point about nfs mounting.

[Burhan I. Koni]

dear Peter
all file systems are local. no NFS is used.

burhan

[Peter Godron]

Burhan,
check, but do not restore, from backup:
/etc/passswd
1 file originally owned by twj
1 file originally owned by apps11i

Check the uids for twj/appl1 in the /etc/passwd file
Check the uids on the files

If the uid in the passwd file has changed that would cause all file owner NAMES to change, but not the uids on the files.

If the uid on the files were changed, review the command histories.

Please report back soon.