make_recovery changes modification date of /etc/passwd and /etc/group

[Mark van Hassel]

Hi,

Out of curiosity:
Does anyone know why make_recovery changes the timestamps of /etc/passwd and /etc/group files.
Is there a special reason for this ?

I noticed this because we keep track of changes to important system files and every time a make_recovery runs the time stamp of the passwd and group files changed.

Thanks,

Mark

[Craig Rants]

Mark,
The mtime changes because ignite moves the inode of every file it backs up. I have found that some IDS systems will generate alerts when ignite is running. Just something that you will have to live with when running this type of backup.

Hope this explains things,
C

[Darrell Allen]

Hi Mark,

That's interesting. It doesn't happen on my 11.0 systems. Are you using the latest Ignite? I'm running:
# swlist -l product | grep -i ignite
Ignite-UX B.3.3.116 HP-UX System Installation Services
# swlist -l bundle | grep -i ignite
B5725AA B.2.2.157 HP-UX Installation Utilities (Ignite-UX)

You may want to start using make_tape_recovery also.

Darrell

[James R. Ferguson]

Hi Mark:

If I recall correctly, Ignite version 3.4 and above fixes this problem by *not* restoring the last access timestamp (atime) of files and thereby leaving the inode change timestamp (ctime) unchanged.

Regards!

...JRF...

[James R. Ferguson · Accepted solution]

Hi (again) Mark:

My memory is semi-intact. This was corrected in Ignite 3.3. From the Ignite site"

http://www.software.hp.com/products/IUX/news.html

/bein_quote/

File mtime, ctime, and atime behaviors have changed in the recovery commands. make_tape_recovery, make_net_recovery, make_recovery, and make_sys_image no longer use the -t option to the pax command. This
option was being used so that the "atime" (access modification time) of the the files being backed up were restored. However a hidden side effect of this -t option was that it caused the the "ctime" (inode modification time) of files being backed up to change. The ctime change triggers tools that do security checks to raise an alarm. Another side effect of the -t option also caused the mtime modification time) of /etc/passwd and /etc/group to be changed due to the way make_recovery used -t in combination with the -s pax option.

/end_quote/

Regards!

...JRF...

[Craig Rants]

Well, I already learned something today, I did not know that they had fixed this in the newer releases.

C

[Mark van Hassel]

Thanks for the quick responses. We have indeed an older version of Ignite running.