syslog timestamp when using passwd command

[M. Hersant]

I have problems when changing passwords (passwd) or switching users. When doing this, the var/adm/syslog/syslog.log is updated with localtime (not GMT). I can't figure out why. Every config file, and the TZ environmental variable is set to GMT. Any suggestions?

[Jeff Schussele]

Hi,

What's in /etc/TIMEZONE?

Rgds,
Jeff

[M. Hersant]

/etc/TIMEZONE

TZ=GMT
export TZ

[Jeff Schussele]

Well...both passwd & su are SUID programs.
So the problem has to be in either root's or the calling user's environment. Don't forget to look in the .?shrc file - depending on the shell defined. Also don't forget to check /etc/profile.

Good Huntin',
Jeff

[Michael Tully]

If the switching of users is to an application user for example, it may have it's own env files called from somewhere. Check the .profile of the user (depending on the shell being used of course) Seeing it is coming from the new user and not the old one, it will be in the env of the user being switched to.

[Steven E. Protter]

There is a variance between variable settings in .profile for root and other users.

This should probably be set in /etc/profile

You should also scan and delete the lines in any .profile files for users that deal with these two variables.

find /home -exec grep -l 'TZ' {} \;

That will get you a list of files, which you can feed into a sed script to nullify the variables.

sed s/TZ/TZOLD/g < fileslist

Make sure if you can't handle it in /etc/profile that the .profile in /etc/skel is correct.

A bit of refinement is necessary.

You also might wish to investigate if your server is pulling time properly from its /etc/ntp.conf file

See if ntpq -p returns a correct time and it comes back GMT.

SEP

[M. Hersant]

After further research, I believe my problem is related to the npasswd program. Npasswd is a replacement for passwd. It has security features which guard against password guessing programs (crack). Is it possible that when npasswd was built and installed, local timezone was probed, and now it is being used as a timestamp? I'll keep looking.