Home directories for "daemon" and "hpdb"

[TheJuiceman]

Hey gang,
I know it is recommended to not have users sharing home directories. According to our HP security audit, this is apparently true for things such as "daemon" and "hpdb" which default for "/". My question is what should be the home dir for these pseudo-logins? Somewhere in /home, /var, or /usr? What files would need to be moved to the new home dirs? Is it just as simple as creating the home dir and changing it in the passwd file?

[TheJuiceman]

Also, should hpdb be a locked account or should it have a password? Thanks again.

[whiteknight]

hi,

It is for allbase/SQL
The user 'hpdb' should be entered in the /etc/passwd file with a user id of 27,
and a passwd of :*: to insure that no one may login as hpdb. The ALLBASE/SQL
"Read Me First" document recommends that the /etc/passwd entry be:

hpdb:*:27:2: hpdb ALLBASE/SQL:/usr:/bin/cs

Allbase/SQL requires the existance of hpdb, if your Customer does
not use Allbase/SQL and has no intention of installing it then they
don't need this user.

However as it's set up you cannot login as hpdb because you don't know the password so unless someone logged on as root changes
the password I'm not sure it's a great security issue.

WK

[A. Clay Stephenson]

It is just as simple as creating a home directory and making the change to the passwd file. The hpdb is only very rarely used these days so if you aren't running allbase (which I seriously doubt that you are) then you can delete that account. It really is unnecessary to modify daemon's home directory because normally the account is disabled so that no one can actually login as daemon. The account still needs to exist because some processes run with an effective UID set to that of daemon but nonetheless no one actually logs in as this user. While this doesn't directly pertain to daemon's home directory, one of the common tasks done during the daemonization of a process is to cd to / so that a running daemon will not prevent a filesystem from being unmounted.

[TheJuiceman]

How would I determine if we are using allbase for anything? What was/is it used for? Thanks again!!!