su: Unknown id: root

[Andrew Beal]

Hi,

Yesterday I went home and all seemed right in the world until i arrived at work thismorning...

I am building a new a-class server with hp-ux version 11.11

Yesterday I could su to root, but thismorning when I logged in and tried I had no such luck and the following error message was displayed...

$su -
password:

su: Unknown id: root

I checked the password file, because I thought that was a bit odd... (just a bit!)

root:*:0:3::/:/sbin/sh
daemon:*:1:5::/:/sbin/sh
bin:*:2:2::/usr/bin:/sbin/sh
sys:*:3:3::/:
adm:*:4:4::/var/adm:/sbin/sh
uucp:*:5:3::/var/spool/uucppublic:/usr/lbin/uucp/uucico
lp:*:9:7::/var/spool/lp:/sbin/sh
nuucp:*:11:11::/var/spool/uucppublic:/usr/lbin/uucp/uucico
hpdb:*:27:1:ALLBASE:/:/sbin/sh
www:*:30:1::/:
webadmin:*:40:1::/usr/obam/server/nologindir:/usr/bin/false
smbnull:*:101:101:DO NOT USE OR DELETE - needed by Samba:/home/smbnull:/sbin/sh
beala01:*:102:20:Andrew Beal,Sydney,02 8272 6780,:/home/beala01:/usr/bin/sh
tates01:*:103:20:Simon Tate,Melbourne,,:/home/tates01:/usr/bin/sh
oracle:*:104:104:oracle,,,:/home/oracle:/usr/bin/sh

The only thing that I changed yesterday afternoon was that I added the oracle, and tates01 user accounts... I also created the wheel group, and changed the perms on

r-xr-x-- /usr/bin/su root weel

I have no idea what has gone wrong, any help would be GREATLY appreciated...

Thanks in advance,

Andrew

[Andrew Beal]

I also found this message in the syslog...

ay 14 09:05:00 melhpux2 su: audit_log: cannot set effective uid before audwrite
May 14 09:05:00 melhpux2 su: - ttyp1 beala01-root

[Patrick Wallek · Accepted solution]

/usr/bin/su, as far as I know, MUST have setuid permission bit set.

What you may have to do is reboot the system, interrupt the boot sequence and come up in single-user mode.

Once in single-user mode do a 'mount -a' to mount everything and then do a:

# chmod 4555 /usr/bin/su

I would leave world execute on su as well unless you have security policies stating otherwise.

[Andrew Beal]

heya! thank you verry much!

I was able to log onto the lan console as root, and change the perms to what you stated.

everything is ok now :)

thanks again,

Andrew

[doug hosking]

Andrew, it looks like you were trying to
restrict who could run su. On HP-UX 11.11
you can add a line to /etc/default/security
that may do some of what you want.
From security(4):

SU_ROOT_GROUP
This parameter defines the root group name for the su
command. Refer to su(1).

SU_ROOT_GROUP=group_name The root group name is set to
the specified symbolic group name. The su command
enforces the restriction that a non-superuser must be a
member of the specified root group in order to be
allowed to su to root. This does not alter password
checking.

Default value: If this parameter is not defined or if
it is commented out, there is no default value. In
this case, a non superuser is allowed to su to root
without being bound by root group restrictions.