SAP <sid>adm user's files in home directory change ownership with different logins

[gbruner]

Hi. I recently had to rebuild /home/adm because some of the config files got deleted or overwritten.. I think I missed something, because I have a problem when I log in as root and su to adm.. As root, if I look at the files in /home/adm, they are all owned by adm:sapsys. That is as it should be. If I su to adm and then look at files in /home/adm, I see that all files are owned by 3201:sapsys. 3201 happens to be the uid of the adm user. This is a problem because I cant run any sap processes with ownership like this.. Any ideas on where to look and what to look at? I know this much, .profile in /home/adm is pointing to run .sapenv_.sh.. and the standard template of .sapenv_.sh is being used..

[Calandrello · Accepted solution]

Friend I find that you desire to modify home of user this if modifies in the /etc/passwd archive

[TwoProc]

If your not using NIS or LDAP to resolve user names, then it sounds to me like your /etc/passwd file is not publicly readable.

Check to see that /etc/passwd is readable by this user.

[TwoProc]

If your not using NIS or LDAP to resolve user names, then it sounds to me like your /etc/passwd file is not publicly readable.

Check to see that /etc/passwd is readable by user adm.

[TwoProc]

Sorry about the double post - the first post hung so long that I didn't think it was going through, so I edited it up a bit and resent. Excuse the extra posting.

[gbruner]

Thank you all! It works! I had recently changed /etc/passwd to 750 because SOX auditors said that it should be that way instead of 444.. Damn auditors.

[TwoProc]

That's funny!

[Bill Hassell]

...should be 750...

That's a very serious error. I would report this lack of experience/training of the auditors to upper management and to not make any further changes to your system until the validity of the recommendations can be verified with experts. The 750 recommendation is TOTALLY wrong since the passwd file must be readable by anyone (ll always reads the passwd file) and to make the passwd file executable is simply ignorant. NO file should be executable unless it is a script or a program. These auditors may know something about PCs but keep them off the Unix systems.

You can verify the correctness of ll the HP-UX file and directory permissions with the swverify command:

swverify

Warning: it will take a while and will load the system fairly heavily.