Several key files in /etc rwritten EMPTY!

[Ken Englander]

The following files were wiped out - new empty files were left in their place.

/etc/inittab, /etc/inetd.conf, and /etc/MANPATH

The system is running HP-UX 11i v3 - Mar08.

Anyone seen anything like this?

Any ideas on a way to figure this out if it happens again or a suggested way to prevent and/or detect it.

I know I can make good copies and set up a cron job to monitor the files, but I am not sure how I might detect the cause of the problem.

Thanks!

[Court Campbell]

Well the person who did it more than likely had root access. You can try to check logs and see if you have any su or sudo logs that show someone switching to root. You can also look at the history file and see if that provides any info. Probably the better way to track this would be with hp-ux hids, tripwire, or aide.

[Ken Englander]

How do I find out more about those tools?

I would suspect an errant program more likely than a human since the systems have limited access. However, it might make sense to restrict root access so su must be used, but that is not setup at this time.

[Tim Nelson · Accepted solution]

HIDS and Tripwire can be found on software.hp.com ( I think tripwire is on the InternetExpress CD ).

Both are freeware.

Tripwire is more for monitoring network traffic and HIDS for monitoring file changes. They would not lock the change out ( I do not think) but you would be notified of the change and perhaps be able to roll-back a copy of the file.

docs are on docs.hp.com

[Kenan Erdey]

Hi,

if you want to try to find out manually, i a script you can check modification date is changed in an infinitive loop. is changed using lsof process can be found. but i am not sure you can get the process after condition is true (file is changed)

Kenan.

[VK2COT]

Hello,

Firstly, if we do not suspect hacking
activity (that includes admins who
have privileges but are clueless as
far as Unix is concerned),then maybe
your root file system is full. I have
seen truncated files when someone
is attempting to save them but there is no space.

Since you run HP-UX 11.31, why not go a step
ahead as well:

a) Configure Dynamic Root Disk cloning

b) Install HIDS, AIDE and/or Tripwire
I used AIDE and Tripwire when I worked
on joint projects with competitors
(IBM, CSC, EDS) to ensure that nobody
can make modifications without ALL
OF US KNOWING ABOUT THEM. It was not a
matter of mistrust but simply a good
housekeeping duty.

Also, I hope you do not share root account
with others. If so, then configure
Role Based Access Control.

For now, I would not trust your server.
A rebuild is the only proper way to go
forward.

Cheers,

VK2COT

[Dennis Handly]

>I would suspect an errant program more likely than a human

The only changes to /etc/MANPATH should occur when using swinstall/swremove on products that add themselves to MANPATH in the control scripts.

[Ken Englander]

I know one more important detail now - the problem seems to have occurred during the installation of CDE - the system actually failed in the middle of the install.

The problem has been repaired so there is no way to examine the problem scenario other than possibly logs leftover.

Thanks all for your input!