sendmail - who am I really ?

[Michael Tully]

This is weird... Wondering if anyone has seen this before.....?

Using my own account, then sudo to root, I am attempting to send myself an email from one server to my exchange email. When it arrives in my inbox it says, it is from a different user. If I login again on the same server using the same method, the problem cannot be reproduced.

env HPUX 11i March 2002 patch release.

Nothing has been changed in sendmail.
No new patches have placed recently.
# what /usr/bin/sendmail
/usr/sbin/sendmail:
$Revision: vw: -RW selectors: 'ic27d' -proj integ -- ph_ic27d_i80 'cupi80_ic27dbase_pb(08-Nov-00.16:48:14)' 'BE11.11_IC27A'
Wed Nov 8 18:39:25 PST 2000 $
Copyright (c) 1998 HEWLETT PACKARD COMPANY and its licensors,
including Sendmail, Inc., and the Regents of the
University of California. All rights reserved.
version.c 8.9.3.1 (Berkeley) 10/01/2000

The user id of the user (sender) is not the same as mine. The /var/adm/syslog/mail.log states the mail is from this user (indicating the problem is not in exchange)

Suggestions.... Or should I be calling a lady with a deck of tarot cards.

Cheers
Michael

[Scott Van Kalken]

Hey Michael,

I'd be tempted to try mailing yourself on the unix box to see the results.

Try from an su

then try from an sudo.

It's always possible that sudo is not playing fair.

[Michael Tully]

Hey Scott,

Thanks for suggestion, still the same unfortunately from that session.

This is what I did:
su -
elm
sent an email to myself on the same server. It posted to my elm mail as the mysterious user.

As 'sudo', the same result....

Michael
PS As I said it is really weird and cannot be reproduced on a new session.

[Jeff Schussele]

Hi Michael,

Do the
whoami
and
who am i
commands output the correct names after su and sudo?
Is there a possibility of duplicate UIDs on this system?
NIS involved here?
.forward files in use by either user?

Rgds,
Jeff

[Michael Tully]

Hi Jeff,

# whoami
root
# who am i
results in my own userid

The same in sudo as root

There are no duplicate user id's (checked already)
Wouldn't go near NIS
No .forward files.

What's that lady's phone number?

Cheers
Michael

[Jeff Schussele]

Do you get the same results with mailx or sendmail?

Jeff

[Michael Tully]

Hi Jeff,

mailx and sendmail give the same result. I am very sure the problem starts before the message actually gets to sendmail for sending. Why my userid converts to someones elses is the mystery....As I mentioned in my original post the mystery userid is embedded in the mail.log instead of mine....

Those tarot cards are looking better :^))
Cheers
Michael

[Scott Van Kalken]

...tusc it.


I'm really interested to kow what this is about now.

[Jeff Schussele]

Me too...them Ozzies have all the fun..... ;^)

It's gotta boil down to basics.
Have you run the *ck series...pw, grp & auth?

Have you examined an env output...carefully...checked your .profile line-by-line?
Any ~rc files hiding out there? Checked the shell binary? Come in as another user & su - to you?

This is quite the puzzler.....

Cheers,
Jeff

[Jeff Schussele]

Oh...and don't forget to think about wtmp/utmp corruption....

Jeff

[Michael Tully]

ha... some fun... This is starting to drive me crazy...

I've already run the *ck progs, and we don't have a trusted system. It is not good opening another session, as the problem does not get reproduced.
no env changes, no strange su's....

no wtmp/utmp corruption

the tusc output.... Well that didn't really show anything...

knock yourself out.....

Its actually beer time, I'm outta here, I check a bit later.

Cheers
Michael

[Robert-Jan Goossens]

Michael,

I've got the same problem on sun/solaris after implementing logical connection security, root can only login to system on local console, su works fine but mail will be sent with original login id.

Called Sun's crc, but they could not give me an answer ?

If you get any answers from your lady's cards PLEASE let me know.

I'll start looking in to a crystal bowl for the mean time.

Kind regards,

Robert-Jan.

[Michael Tully]

Robert-Jan,

I think you've mis-understood the question....

The output from tusc, doesn't look like it made it, so I'll re-post it tomorrow AM my time. I'm certainly all for more suggestions....

Michael

[Christian Gebhardt]

Hi

I had the same effect on some machines and I answered to thread
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x2d9f93e260b0d611abdb0090277a778c,00.html

In our case it's a problem with utmp/wtmp files and login via ssh:

whoami --> root
who am i --> root
id --> uid=0(root) gid=...
logname -->

Solution:

empty /etc/utmp /etc/utmpx /var/adm/wtmpx /var/adm/wtmp
and reboot the machine

Chris

[Michael Tully]

Here is the tusc output for anyone that is interested.

Unfortunately we do not use 'ssh' for some of our systems, this is one. None of the Xtmp file are corrupted.

That lady with the deck of cards is lokking better all the time.....

[John Palmer]

What type of crystal ball do you need to read that attachment Michael? ;-)

[Christian Gebhardt]

Hi
Nethertheless
what's the output from 'logname'?

logname uses the same routine to show the user as sendmail.

Chris

My grandma is very familiar with cards ...

[Christian Gebhardt]

Hi
netherless, what's the output from 'logname' ?
logname uses the same routines as sendmail to fetch the user.

Chris

My grandma is very familiar with cards ...

[Elif Gius]

Maybe you have a corrupt utmp/wtmp file.Create new one.

do a backup of the files, then
cp /dev/null /etc/utmp
...

logoutand then login again,if you use "logname" ,it will now give the correct user

Attention: Your current logon-information will be lost (so it would be the best that all users logout from the system)

[Michael Tully]

Unfortunately guys, this one one of my main production warehouse systems, so I cannot just get all users to log out....
There is no problem with either my logname or the Xtmp files (mentioned previously)

Thanks for the assistance, but this system will reboot tomorrow when everyone is asleep. (meaning the session I had will terminate) I'll keep an eye on it and see what happens next week. Unless somebody has something new to add, I'll consider this thread closed.

[Steven E. Protter]

There area lots of tricks you can play there.

in /etc/aliases you can have an entry like....

steve@schmobagel.com steve

All mail coming into to that goes to the steve account on the local box, whether its HP-UX or Linix, or whatever.

But to do this, you need a good m4 script to build the binary databses. If this is of use to you(helps with your issue) pop a point or two, reply to this post and I'll upload you a script.

There may already be a script in the itrc forums called buildmail, because I think I already posted it.

Steve