Strange message from whoami - Intruder Alert

[Al Miller]

Can someone explain to me under what conditions the whoami command will return Intruder Alert. I am seeing this returned to my logs in some batch processes I am running.

[Patrick Wallek]

If I remember correctly, this happens when /etc/passwd file is not world readable.

/etc/passwd should be, at a minimum, 444 permissions.

[Kelli Ward]

Hi,
I believe you will see this message if a user attempts to log in but either, is not listed in /etc/passwd or if /etc/passwd is not world readable.
Hope this helps,
Kel

[Patrick Wallek · Accepted solution]

If you need more information, check out TKB document W3449877.

To summarize, /etc/passwd should be at 444 permissions with root:sys as owner and group, and the /etc directory should be at 666 permissions with bin:bin as owner and group.

[S.K. Chan]

I can think of 3 conditions ..
1- password file is corrupted
2- password file permission is set to 400
3- wrong NIS domainname

[Martin Johnson]

This happened to me last week. The /var file system filled up. This resulted in the ServiceGuard software to terminate and all sorts of weird things happening, including the "Intruder Alert" from whoami. I cleared out some core files from /var.

I was logged in my pseudo root account. I tried to run shutdown. It said I wasn't authorized. I "su-ed" to root. shutdown wouldn't run because it couldn't determine my username. I use "reboot" instead. Everything came up fine after the reboot. whoami worked fine after the reboot.

Weird!
Marty

[Bill Hassell]

As you have seen, /var is a critical filesystem and must have lots of empty space available. You can start by eliminating core files completely with the statement:

ulimit -Sc 0

in /etc/profile. This assumes that all your user logins are using /usr/bin/sh as their shell (and root must use /sbin/sh).

Then find out where the big stuff is located--not big files, but big directories! Use du as in:

du -kx /var | sort -rn | /tmp/du.var

Look at the top of the du.var file for hints. In a ServiceGuard environment, you don't want much of anything in /var/mail or /var/spool. /var/adm will be large for 2 reasons: /var/adm logfiles, and /var/adm/sw for installs and patches. /var/adm/sw is a good candidate for it's own lvol.

And also /var/ad,/crash which should empty if you keep up on patches, otherwise, create an lvol for the crash directory. Use symlinks to avoid having to change config files.

[Martin Johnson]

Thanks Bill!

I usually put /var/adm/sw and /var/adm/crash in their own lvols. On this particular system, it wasn't done as this system was setup by consultants. I'll have to add it to my "todo" list.

Marty