su shows wrong user

[Ben Thomas]

Running HP-UX 11.00 in trusted mode.
su from root to another user, but sulog shows another user. e.g.
SU 04/25 11:09 + 0 panama-maestro
Also mail from root is recorded as from "panama".
pwck -s does not display any errors, and there are no duplicate UID's.
I assume problem is with authentication database, but have no idea how to fix it!
Any help would be greatly appreciated.

[Sachin Patel]

Hi Ben here is what happening.

I am login as user sachin then run su - to become root then run su - patel and look what happen.

# whoami
root
# who am i
sachin pts/3 Apr 25 11:05

#su - patel
patel%exit
#tail -2 /var/adm/sulog
SU 04/25 11:25 + 3 sachin-root
SU 04/25 11:27 + 3 sachin-patel

But if you login to system via telnet as user root look what happens

#telnet rem1
Trying...
Connected to rem1.test.com.
Escape character is '^]'.
Local flow control on
Telnet TERMINAL-SPEED option ON

HP-UX sagan B.11.00 U 9000/800 (t0)

login: root
Password:

#su - patel
patel%exit
#tail -1 /var/adm/sulog
SU 04/25 11:29 + t0 root-patel

Conclusion: if you run su - then it source your profile so you have entry like
SU 04/25 11:09 + 0 panama-maestro


Sachin

[Steven E. Protter]

If the system was created by Ignite and the /etc/passwd file wasn't included, this could cause the problem.

If its not an Ingite problem then:

1) A manual change has been made to /etc/passwd

2) The user panama actually did su to root and knows the password.

I am gessing there is an error in /etc/passwd that doesn't show up on pwck -s

log on.

Try this:

whoami
who am i

Do the su thing.

whoami
who am i

See if that sheds any light on the situation.

SEP

[Ben Thomas]

Thanks for the comments, but does not help.
When logging in as root, we do not 'su' to root but are logged in using SSH. While logged in, running a tail on the sulog you can see the message "su : + 0 panama-maestro".
Also, all mail messages generated by root appear to come from 'panama' -- which does NOT have UID=0.
We have 25 HP systems, and this is the only one that does this.... It does not interfere with production, as it only seems to occur to the 'root' account -- but it is really weird.

[Dario_1]

Hi:

Run the id command in both accounts and compare the output.

Regards,

DR

[Michael Tully]

Hi Ben,

I had a similar problem back in December.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x92640fe6d0f7d61190050090279cd0f9,00.html

I never did solve it, and it has not come back to play either. I have a feeling it ended up being some corruption in the /etc/utmp or /var/adm/wtmp file. Once that system rebooted and new Xtmp files were created the lady with the tarot cards never dealt me another hand.

Regards
Michael

[doug hosking]

I'm suspicious that the problem is related to stale entries in /etc/utmp or /etc/utmpx.
If the machine can be easily rebooted I would be tempted to try renaming /etc/utmp and /etc/utmpx, 'touch'ing them back and resetting the original owner/group/mode then rebooting.

[Stuart Campbell]

I am having a similar problem with HP-UX 11.00
When I login using tty tyb and su to root it shows the su as a different user. It only happens on tyb and it is always the same user.