1832279 Members
2195 Online
110041 Solutions
New Discussion

/lib losed

 
piyut_1
Frequent Advisor

/lib losed

gurus,

why /lib that link to /usr/lib losed itself??
how can root access only by sysadmin???
5 REPLIES 5
Steven E. Protter
Exalted Contributor

Re: /lib losed

root access is only by sysadmin because only a systems administrator should be messing around with some things that root has access.

sysadmin=root user
root user should be sysadmin.

Wondering if you recently upgraded from HP-UX 9 to 10 or above or something.

If that link is gone it was either erased or it was damaged by some kind of hardware failure.

IT may not be time to check hardware and restore this system to a known, working backup, at least vg00.

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
piyut_1
Frequent Advisor

Re: /lib losed

can common user access as root with .rhosts or other configurations file???
i just disable rlogin in my server hp-ux B 11.11.
what use of /lib ????
Gordon  Morrison
Trusted Contributor

Re: /lib losed

/lib should be a symbolic link to /usr/lib
If the link is not there, re-create it like this:
ln -s /usr/lib /lib

I believe the link exists for backward-compatibility: lib used to be /lib, but then they decided to move it to /usr/lib and they created the link to that old software would still be able to find it.

I think it is possible for a non-root user to rlogin as root without a password if root's .rhosts is set up to allow it. If it is, I would change it immediately. The use of .rhosts is very convenient, but very insecure.
What does this button do?
piyut_1
Frequent Advisor

Re: /lib losed

gurus,

i don't find .rhosts that enable non-root user to login as root.in /etc/sudoers only one non-root user that can sudo as root without password, he is me.now,/lib is gone again.how come???
Gordon  Morrison
Trusted Contributor

Re: /lib losed

This sounds suspiciously like someone has created (or changed) a cron job to periodically delete it, and possibly other things. Have any disgruntled employees recently left your company?
Also check for suspicious at jobs that re-spawn themselves.
Also check sulog and syslog, as someone may have the password and just not know what they're doing.
It would probably be an idea to change the password if you haven't already.
What does this button do?