SU to Root gives me wrong user in SULOG!

[Anand Bhairosingh]

Hi all,

Logged in as myself gives me another username in the SULOG whenever i perform "su - root".

And this only happens when i'm using "pts/1".

Anyone any idea what's happening here?

[Pete Randall]

What happens if you just use "su" (without the "-" and without the "root")?


Pete

[Cheryl Griffin]

How are you originally logging into the machine? Telnet using Exceed or another package? There was an old issue where Exceed did not update the /etc/utmp. It may be the issue here.

[Cheryl Griffin]

Here is a command that can give you the /etc/utmp entry. Verify that it is right:
/usr/lib/acct/fwtmp < /etc/utmp | grep pts/1

Or you can use:
/usr/lib/acct/fwtmp < /etc/utmp

[T G Manikandan]

Also check for the latest su patch
http://www1.itrc.hp.com/service/patch/patchDetail.do?patchid=PHCO_16127&admit=-682735245+1057750369935+28353475&context=hpux%3A800%3A11%3A00

[T G Manikandan]

Also check this
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xb28238dfa974d711abdc0090277a778c,00.html

[Steven E. Protter]

pwck

grpck

There may be a consistency problem in /etc/passwd

By chance have we tranferred some users?

rmsf the psuedo terminal

insf -e

This should help.

Back the system up first.

SEP

[Anand Bhairosingh]

Hi,

Thanx all for youre reply's.....

Pete Randall:
Just an "su" is enough to reproduce this.

Cheryl:
I use xterm to connect to system.

utmp and wtmp looks fine. information in
these files looks correct.

Manikandan:
We don't have this patch installed. Info
about this patch does not imply solving
this issue.

I had allready been looking for messeges
about this issue. Have seen some of it, but
didn't find any solutions.

For now, rebooting is not an option.

Steven E. Potter:

did: rmsf /dev/pts/1
did: insf -e

Problem still not solved.

How can i check wether i have consistency
problem in /etc/passwd or /etc/group?

Looking in it, the information seems to be
correct. What should i be looking for?
---------------------------------------------

Does not matter what user is logged on pts/1. As soon as you do su, problem pops up.
It also does not matter TO what user you su!!

Gr.
Anand Bhairosingh.

[Alex Glennie]

The su(1) command obtains the 'from' name (as seen in the sulog) from
getlogin(), if getlogin() fails it is found by getpwuid(getuid()).
In turn getlogin() ultimately finds the user by checking the
/etc/utmpx file for the control tty associated with the current
session leader process (check man getlogin and getutx).

I guess that utmpx could be corrupt, hence getlogin returns an old or invalid entry.

could try zeroing both utmp/utmpx with
cat /dev/null > /etc/utmpx
cat /dev/null > /etc/utmp

[Anand Bhairosingh]

Alex Glennie:

What about users that are loggen in at this moment?

Can i just clean those files without cuasing any onther problems?

[Alex Glennie]

no this needs to be done at single user level and it would be wise to reboot after ...

[Anand Bhairosingh]

Hi all,

Thanx for your support.

doing cat /dev/null on utmp, utmpx, wtmp and wtmpx solved my problem.

Just did it while being "UP" (so didn't go to single user mode as advised and didn't reboot the system).

Thanx Alex.

Gr.
Anand.

[Jeff Schussele]

Hi,

I think Alex is correct i.e. you have/had a corrupt utmpx file. We ran into the same thing.

You should look at & probably apply PHNE_24829 as this problem is liable to pop up again.

Here's one of the symptoms from it's info page:
SR 8606220839 / CR JAGad89975
3. Incorrect records might be written into /etc/utmpx
by telnetd when it exits.

Pay careful attention to the special instructions for this patch.

HTH,
Jeff

[Steven E. Protter]

pwck checks the /etc/passwd file for problems
grpck checks the /etc/groups file for problems

I think the patch is your solution though.

SEP