HP Configuration

[navin]

Hi,
I have a HP server ,most of the etc configuration files had changed suddenly over night.Could not collect messages of the console during the incident.log files were mt since syslog was not running on the particular incident .What could have caused this .Any body had this kind of incident.
thanks in advance for any useful info.

[A. Clay Stephenson]

"most of the etc configuration files" is not very specific. Changed? How, specifically. Which files? Specifically.

In any event there is no inherent facility to do what you seem to be describing. What I would look for is when the machine was lasted booted. You may not be running on the boot disk (and hence, /etc) that you think you are running on. The only other thing that might cause something like you describe is a very long running swinstall or swupdate that just happened to finish or was triggered as a result of a reboot. Of course, don't overlook human intervention (intentional or otherwise) --- possibly a restore from backup operation.

Now, why was syslogd not running? That does sound extremely suspicious --- or a filesystem may be nearing to filling up.

[navin]

Thanks so much for the reply.That was very good point.But system has rebooted so many after the update.
The files that changed are dns resolv file,internet daemon file,passwd and switch files and syslogd conf file.
Thanks

[Raj D.]

Navin,

well passwd file usually dont get change if you install any software apart from it may adds some more user, but dont remove anything, though certain software changes cron and your old crontab disappears, so you need to have old configutaios you can restore those files from.

Check exactly what are the things have changed from the reboot, and then you can take a decission to correct them. /etc/resolv.conf and /etc/nsswitch.conf can be rebuild if you have name servers informations. Or can be copied from a similar system on the network.

hth,
Raj.

[D Block 2]

Navin- what Update ?

Was there a new Haredware or Sofware Path Install ?

It could be, that someone else has changed or updated the /etc files ?

Please let us know if you need anyhelp w/ security or Audit logs.

[navin]

Raj and Tom ,
Thanks so much for the reply.I really appreciate it.

I meant the swupdate.The system was upgraded couple of months ago with swupdate command.

But may need help on security or the audit log.
thanks

[Raj D.]

Navin,
which os version are you using, and exactly what command you used during update.

Here is a document for hp-ux security:

http://www.nortel.com/solutions/securenet/collateral/hp-ux_hardening_guide_v1.pdf

cheers,
Raj.

[Raj D.]

Navin(again),

Also check the while paper on security, may help you to understand basic/advanced security env,

http://www.nasi.com/pdfs/hp-ux_security_whitepaper.pdf

cheers,
Raj.

[Bill Hassell]

swupdate?

There is no such command in HP-UX. Did you mean swinstall? If so, that command is meaningless without a list of patches or a patch bundle. Even so, no patches will change the /etc directory. If there are new versions of the config files (such as sendmail.cf), the patch will NOT replace your old config file. So it is unlikely swinstall changed anything in the /etc directories.

If instead of swupdate, you meant update-ux then yes, I would expect a lot of things to change, mostly for the worse. That's because updating HP-UX to a different version (in general) is very seldom successful.

There is a single command that will cause the problems that you describe:

cp -r /usr/newconfig/etc /etc

The problem you describe is a root user problem. Nothing in HP-UX will ever do this.