howto change egid of root

[Ceesjan van Hattum]

Hi,
If i do 'id' after a 'su -', i see the egid=20(users).
This gives me some problems and i just want to get rid of the egid.
Who can help me (hpux 11.11) ?

Regards,
Ceesjan

[harry d brown jr]

take root out of the users group.

live free or die
harry

[Steven E. Protter]

Use sam users and groups section, choose the root user to carry out Harry's instruction.

SEP

[Ceesjan van Hattum]

Sorry Harry, but it doesn't help me.
egid is still set to 'users'. Also confirmed by other systems. Maybe some strange bit set on /sbin/sh or su ?
Regards,
Ceesjan

[Ceesjan van Hattum]

The system runs in Trusted Mode. Maybe some side effect?

[harry d brown jr]

I'm not getting the same behavior:

# telnet vpart1
Trying...
Connected to vpart1.paychex.com.
Escape character is '^]'.
Local flow control on
Telnet TERMINAL-SPEED option ON
GenericSysName [HP Release B.11.11] (see /etc/issue)

login: hbrown
Password:
Please wait...checking for disk quotas

$ id
uid=104(hbrown) gid=20(users)
$ grep hbrown /etc/password /etc/group
grep: can't open /etc/password
/etc/group:users::20:hbrown
$ grep hbrown /etc/passwd /etc/group
/etc/passwd:hbrown:PASSWORD:104:20:harry,webster,0574,7582:/home/hbrown:/usr/bin/ksh
/etc/group:users::20:hbrown
$ su -
Password:
(c)Copyright 1983-2000 Hewlett-Packard Co., All Rights Reserved.
WARNING: YOU ARE SUPERUSER !!

# id
uid=0(root) gid=3(sys) groups=0(root),1(other),2(bin),4(adm),5(daemon),6(mail),7(lp)
# grep root /etc/passwd /etc/group
/etc/passwd:root:PASSWORD:0:3::/:/sbin/sh
/etc/group:root::0:root
/etc/group:other::1:root,hpdb
/etc/group:bin::2:root,bin
/etc/group:sys::3:root,uucp
/etc/group:adm::4:root,adm
/etc/group:daemon::5:root,daemon
/etc/group:mail::6:root
/etc/group:lp::7:root,lp
#


live free or die
harry

[Ceesjan van Hattum]

I get the following:

login: hattumc
Password:
>(c)Copyright...
$ id
uid=111(hattumc) gid=20(users) groups=4(adm)
$ su -
$ id
uid=0(root) gid=3(sys) egid=20(users) groups=0(root),1(other),2(bin),4(adm),5(daemon),6(mail),7(lp)
$ grep root /etc/group /etc/passwd
grep root /etc/group /etc/passwd
/etc/group:root::0:root
/etc/group:other::1:root,hpdb
/etc/group:bin::2:root,bin
/etc/group:adm::4:adm,root,hattumc,install
/etc/group:daemon::5:root,daemon
/etc/group:mail::6:root
/etc/group:lp::7:root,lp
/etc/passwd:root:*:0:3::/:/sbin/sh

$ #this is what i do not like:
$ perl
No program input from stdin allowed while running setgid.

$ # So i already tried:
$ echo "-g SETRUGID" >>/etc/privgrp
$ setprivgrp -f /etc/privgrp

But setprivgrp, which is normally not used on the system, doesn't help either.

What else is there to check?

[Patrick Wallek · Accepted solution]

It sounds to me like you have a customized su program. Try a couple of things:

$ /usr/bin/su -

To go to root.

Also try:

$ ll $(whence su)

$ what $(whence su)

Your su binary should be similar to:
# ll /usr/bin/su
-r-sr-xr-x 1 root bin 28672 Oct 4 2002 /usr/bin/su*

# what /usr/bin/su
/usr/bin/su:
$Revision: @(#) all CUP11.11_BL2002_1004_2 PATCH_11.11 PHCO_27781
Fri Oct 4 00:27:58 PDT 2002 $

[John Carr_2]

Hi

in both your postings you refer to egid=20 rather than gid=20 is there something I am missing here.

can you cut and paste your output please.

John.

[Ceesjan van Hattum]

I see...
On the system i have:
#ll $(whence su)
-r-sr-xr-x 1 root bin 24576 Nov 14 2000 /usr/bin/su
ontob3:/#what /usr/bin/su
/usr/bin/su:
$Revision: B.11.11_LR
Wed Nov 8 20:03:34 PST 2000

While on another system i have:
ll $(whence su)
-r-sr-xr-x 1 root bin 28672 Oct 4 2002 /usr/bin/su
ontob2:/archive# what /usr/bin/su
/usr/bin/su:
$Revision: @(#) all CUP11.11_BL2002_1004_2 PATCH_11.11 PHCO_27781
Fri Oct 4 00:27:58 PDT 2002 $

So.. i'v replaced su and it runs well.
THANKS,
you've triggered my to rescan all patches.
Kind Regards,
Ceesjan
(case closed)

[Ceesjan van Hattum]

For everybody who is interested:

The cause of the problem was different than all of the above:

In the .profile of root, there was a last line 'ksh' appended.
So.. a shell calls directly a shell..
This ksh was /usr/local/bin/ksh
with -r-x--S--- from userX of group users.

The former administrator left the building..
Nice.. isn't it...

Regards,
Ceesjan