passwd file getting corrupted?

[Irfan Ahmed_1]

Hi all,
When /var filesystem get full(100%) ,then the system restarts always in single user mode. And then I have to remove some files from /var & then reboot the system to come up in multiuser mode. But everytime this happens the password file gets corrupted. I have to always keep a backup of password file(/etc/passwd)
I want to know the reason for this & how can I avoid this problem

Thanks
-Irfan

[A. Clay Stephenson]

First of all, you never want /var to become full because that filesystem (probably above all others) will bring your system down. It's not al all obvious why filling up /var would in anyway corrupt /etc/passwd; in fact, the passwd file should really only see changes on a very infrequent basis and only from a very small set of programs. You should be monitoring the modification times of /etc/passwd to see if its being updated often and make sure that the permissions are 444 and that it is owned by root.

You seem to be trying to fix the symptoms rather than the problem itself and I really don't think they are related in any way.

You should really split var into several filesystems (e.g. /var/tmp, /var/spool/lp, var/mail) because again, filling up /var will crash your box. I do assume that /var really is a separate filesystem because if not there could be a relationship between /var (now /) and possible passwd corruption.

[Stf]

Hello,

what did you remove from /var filesystem?

Stf ;-)

[c_51]

i would guess that this has something to do with pwgrd (Password and Group Hashing and Caching daemon) and that it's hash files and etc. are under /var/spool/pwgr/

[A. Clay Stephenson]

I am taking you at your word that the passwd file itself is somehow being corrupted; if that is true then the pwgrd can have nothing to do with that. The next time this happens do a diff of /etc/passwd and your backup file. How are they different? That should give you very good clues as to what is actually happening. Again, you are really fighting the wrong problem. You should have disk watchdog daemons in place that never let this situation occur.

[Mark Greene_1]

And because no one else has said it, I'll go ahead and venture a guess that you're being hacked.

Have you taken a look at last and lastb and correlated login times to those times when /var is filling? Have you looked in whatever log files you have syslogd writting to for corresponding error messages?

mark