SU problem

[abhijit chaphekar]

i get error while using su "su: Your own ID is unknown."
please help
thanx

[Stefan Farrelly]

My only guess is that your current id is no longer in the passwd file, as when you su (to root) an entry must be added to the su log in /var/adm stating - root (+date/timestamp) and if your id isnt in the passwd file it cant add an entry to the su log. Check your id and that is currently in the passwd file.

[abhijit chaphekar]

stefan,

Iam root and when i try to "su" to other id's like oracle etc i get this error.The root is present in passwd file .

thanx in advance

[James R. Ferguson]

Hi:

I would check the password and group files and fix any errors found. Try the following:

# /usr/sbin/pwck
# /usr/sbin/grpck

...JRF...

[Bruce Laughlin]

Hi,

I'm going to make some assumptions about your system, based on things I know about su:

1) You're running 10.20
2) Your system is trusted.

Based on these assumptions, and knowing how su operates, I believe that su is attemtping to do a getprpwuid() call, which is failing, and thus generates the error message you're seeing. One possible cause of this is a damaged or missing entry for root in the Trusted Computing Database (TCB). For example:

# cd /
[root@ooodarn]/
# cd /tcb/files/auth/r
[root@ooodarn]/tcb/files/auth/r
# su bal
[root@ooodarn]/tcb/files/auth/r
# exit
[root@ooodarn]/tcb/files/auth/r
# mv root root.orig
[root@ooodarn]/tcb/files/auth/r
# su bal
su: Your own ID is unknown.
[root@ooodarn]/tcb/files/auth/r

Here's an example of a good /tcb/files/auth/r/root entry:
root:u_name=root:u_id#0:
:u_pwd=J7wCIvL3jn4IA:
:u_bootauth:u_auditid#0:
:u_auditflag#1:
:u_pswduser=root:u_suclog#970015107:u_lock@:chkent:

I suspect that when you recover or repair this file, your su problem will be solved.

Regards,
Bruce Laughlin

[abhijit chaphekar]

Bruce,

That is not the case here, as the file root under tcb is not changed.but the error is same.
any suggestion would be great help.

Thanx

[Stefan Farrelly]

Hi,

can you send us a copy of your /tcb/files/auth/r/root file so we can see if it looks ok (you can remove encrypted password string if you like for security reasons) ?
And a copy of your passwd file (as its a trusted system no password strings here) ?

[Stefan Farrelly]

Here are some links to similar errors and solutions; One of them should be your case, I hope!

http://europe-support2.external.hp.com/cki/bin/doc.pl/sid=711f1c6a15c17a3b6a/screen=ckiDisplayDocument?docId=200000024631896

http://europe-support2.external.hp.com/cki/bin/doc.pl/sid=711f1c6a15c17a3b6a/screen=ckiDisplayDocument?docId=200000015248058

http://europe-support2.external.hp.com/cki/bin/doc.pl/sid=711f1c6a15c17a3b6a/screen=ckiDisplayDocument?docId=200000024602421

[Bruce Laughlin]

Hi Abhijit,

I'm reasonably sure that there is something wrong with your /tcb/files/auth/r/root file, we just don't know what it is yet :-)

I noticed in my previous post, some of the characters did not show up in my message. Specifically, each of the lines in the file, except the last, should be terminated with a backslash which is the line continuation character. If the line is not terminated this way, or is otherwise corrupted (i.e. missing characters, extra characters), su will fail in the same way.

Hope this helps,
Bruce Laughlin

[abhijit chaphekar]

Hi Stefan/Bruce,

The password file and root file is attached with this message.Please view them.

regards,

[Bruce Laughlin]

Hmm... well, you've got me baffled... almost. I know that the error is resulting because getprpwuid() isn't able to read the TCB file. The only other reason I can think of that this would happen would be some sort of permissions problem.

1) I notice that you have lots of users with uid 0 in your password file. When you say you're executing su as root, do you mean that you're logged in as the root user, or one of these other so-called root users?
2) If not logged in as root, are you su'ing to root from another user?
3) Check the permissions on /usr/bin/su, it should be 4555, owner root, group bin:
# ll /usr/bin/su
-r-sr-xr-x 1 root bin 20480 Jun 10 1996 /usr/bin/su

If this doesn't give a clue as to what's going on, then I'm out of ideas, for now...

Bruce

[Devbinder Singh Marway]

Try running authck -a ( checks the authentication dbase for inconsistencies )

see what this reports .

[Devbinder Singh Marway]

one thing looking at your password file is
roots home directory is /usr1/root , is this correct ?

[Vincente Fernandes]

Abhijit,
Trace your login flow on the server. Do you use any IBBS control S/W or audit S/W. I guess sometime back Citi started implementing audit control S/W(Forget the exact application name). I guess your are part of Citicorp-Bombay. As per my past experiences with Citicorp HP systems they have their own su written. Also check and make sure "su" file path is the standard as per HP-UX. I had good experience with Citicorp audit software while supporting the said citicorp countries from Bahrain. Mail me at vincentef@hotmail.com if you want any help.

[Sanjay Dudeja]

Hi Abhijit,

The following could be your problem -
When you created oracle id on your system it assigned a Authentication number. The tcb file of oracle will have that number stored. Once you remove the same your problem should be sorted out.

The entry in your tcb file will look like this
:u_pw_admin_num#197

I have faced this problem a number of times.

[abhijit chaphekar]

Hi guys,

Thanx for the help. The tcb database was corrupted .we had to rebuid it .
authck did help me to track the error.