how to fix "duplicate audit id"

[John Kittel]

HP-UX 11.11, trusted.

authck tells me I have a couple accounts with duplicate audit ids. What is the proper way to fix this?

Can I just use vi to edit the proper file in the tcb and change the audit id?

For those accounts that have duplicate audit ids, in each case there are 2 accounts with the same id. I know which account I want to retain that id, and I know what the desired id is for the other account, and that that id is not in use. I know this because the system is a member of a serviceguared cluster, and the other cluster node is almost identical, except for this. The other node has noe authck warnings. So if using vi to change the tcb file will not leave or create some other side effect, then it will be a simple matter for me to fix.

- John Kittel

[Todd McDaniel_1]

You can use vipw...then run your pwck again or your trusted command to check /etc/passwd.

Make sure that ~home ownerships are right and file ownerships are as well.

[Steven E. Protter]

A common issue after conversion to trusted:

http://forums1.itrc.hp.com/service/forums/parseCurl.do?CURL=%2Fcm%2FQuestionAnswer%2F1%2C%2C0x6fd10bce6f33d6118fff0090279cd0f9%2C00.html&admit=716493758+1080762752300+28353475

Happened to me as a matter of fact.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=139389

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=67705

No perfect thread here. My notes are not available.

I probably have a software contract call on the issue. If I have time, and you havent indicated solution via rabbit, I may post in some text later today.

There is a solution in one of the above threads.

SEP

[John Kittel]

Todd, unless I'm mistaken, I don't think your answer addresses my problem. I'm not talking about the uid in the passwd file. I'm talking about the audit id in the file in /tcb/files/auth/...

Home dir and file ownerships are all ok.

- John

[Todd McDaniel_1]

oops! my bad... aint the first time I misread a post!

[John Kittel]

No problem Todd.

Thanks for the reply SEP. I will probably still need some more help. Before posting my question I had already searched the forums and technical knowledge base and read several items including those you posted. But now I've gone back and re-read them. In two of them Shiju Wilson recommends a knowledge base doc 200000048391508 which I can't find by search for either subject or doc id. Almost all the stuff I'm finding relates to problems with cron and invalid audit id.

I did find a technical doc id KBRC00004823 regarding the error message "bad audit flag" during logon, and it suggests editing the tcb file to correct the info, so perhaps that would be an acceptable solution for me. However it states that the audit id should equal the line number in the passwd file for the acct, and that couldn't be right, could it? I mean, what if you delete an account... then the audit id's for all the subsequent accounts would be wrong.

I should also mention that I don't care about maintaining the cosistency of historical audit info, if any exists. I've never looked at or configured any auditing ( other than conversion to trusted). At this point I just want to get rid of the duplicates and get authck to stop warning me.

- John

[John Kittel]

I see that "modprpw" allows modification of auditid. But of course the man page warns modprpw should only be used by SAM... so I am reluctant to try that.

- John

[Jeff Schussele]

Hi John,

modprpw can be safely used outside of SAM we do it all the time. You just want to be sure that you don't typo anything - like the user's name.
In your case syntax would be like:

/usr/lbin/modprpw -m audid=new_value -l user_name

Caveat here is the new audit ID can't exceed the next available ID & must be unique - or you're back in the same boat.
Then it can be checked with getprpw - like:

/usr/lbin/getprpw -l -m audid user_name

Rgds,
Jeff

[John Kittel]

Thanks Jeff re: use of modprpw.

It has gotten a little more complicated. I now realize I was incorrect in my original post. I now see almost all the audit ids on the other node are different, even though the passwd files and most of the tcb files are otherwise identical. The underlying reason I'm discovering this now is because I am preparing to follow advice in technical doc id UXSGKBAN00000227 regarding syncing password on ServiceGuard hosts. It recommends copying the tcb files. I have already read other forum threads regarding use of NIS or LDAP for authentication in order to circumvent this ServiceGuard password sync issue and intend to go to LDAP later this year; this copying of the tcb files was only intended to keep things working until then.

Since UXSGKBAN00000227 recommends copying tcb files from one host to another, and KBRC00004823 recommends editing the tcb, and I'm not auditing now anyway, I'm just going to go ahead and copy the tcb files.

- John

[Jeff Schussele]

OH - OK, I see now.
Again that's another thing we do frequently.
Just get the system quiescent - get all the users off - use /etc/NOLOGIN, etc

Then tar & copy/ftp/whatever:

1) /etc/passwd
2) /etc/group/
3) /etc/logingroup #or relink to group
4) /tcb/*

and then I also like to copy

5)/home/* #just so they match - may want to warn users of this one first so they can prepare for it - ya know save their unique stuff from the destination to the source so when the copy's complete - they lose nada.

Rgds,
Jeff

[John Kittel]

Thanks again Jeff.

Although no one pulled a rabbit out of the hat specifically answering how to remedy duplicate audit ids, I am sufficiently tired of this that I don't wish to pursue it further, unless someone sees that I am grossly ignoring something important and wishes to further enlighten me.

- John