security question

[james gould]

When doing a whoami command as a regular user
the following message appears :
Intruder alert

Does not happen when running the same command
as root.

O/S is 11.00

[Giri Sekar.]

whoami reads the /etc/passwd file for info. check the permissions and if it is not readable for users then you would get this message. Does not happen for root 'coz root will have the permissions on it.

[James R. Ferguson]

Hi James:

Make sure /etc/passwd is readable by everyone:

-r--r--r--

Regards!

...JRF...

[james gould]

Permissions are open for read only on both
passwd and group files.

When running a password check if anything is
wrong in the file could that cause this error
to appear??

[MANOJ SRIVASTAVA]

the permissions of /etc/passwd fuile are r-- --- --- change it to r-- r-- r-- and you are good to go.


Manoj Srivastava

[Giri Sekar.]

The decision would be yours. If you make the /etc/passwd file as 444 then you will not get this error. But you may have turned it off for security.

[MANOJ SRIVASTAVA]

Also James
check whether there are two or more user having the same user id this wil also cause whoami to give intruder alert.


Manoj Srivastava

[James R. Ferguson]

Hi (again) James:

Make sure the permissions of '/etc' (and '/') allow read and execute to everyone, too. Do:

# ls -ld /
# ls -ld /etc

Regards!

..JRF...

[Rob Fisher]

I have permissions -rw-r--r-- on most of my servers. If you set these permissions make sure that the owner is root and the group is root.

Good luck

[brian_31]

Hi James:

Did you get a chance to look into your profile??? 3/125(points alloted). If you feel all the above answers are dumb then put N/A.

Thanks
Brian.

[james gould]

All permissions are ok

Will try restoring passwd file from backup and
see if that does the trick

[Jerry Anderson_1]

According to what I read online (Google search) this message has nothing to do with file permissions.

If the current user ID is not in the password file, the message Intruder alert is displayed.

I'm not sure under what circumstances you could end up with a UID that is not in the password file, but that appears to be the case here.

[james gould]

Restored a backup of the passwd file and it
fixed the problem. Seems that another admin
modifed a user password so they could not login
and deleted the UID by mistake.