UID above 65535 getting reset to 60001

[vinod_25]

Hi UNIX Champs,

I am facing a head scratching issue with HPUX B.11.00 U 9000/800 2005414283 unlimited-user license.

From recent past we are facing an issue with this server on UID reset. A set of 10 users whose UID's are above 65535 are getting automatically reset to 60001 occasionally. Please let us know if anyone knows the root cause of this issue.

For more information: we have put in a cron that runs every hour collecting UID 60001 from /etc/passwd and found on someday 10 users got their UID's resetted automatically.

Wed Oct 11 09:00:01 EDT 2006
nobody:*:-2:60001::/:
Updated
Wed Oct 11 10:00:00 EDT 2006
nobody:*:-2:60001::/:
Updated
Wed Oct 11 11:00:00 EDT 2006
nobody:*:-2:60001::/:
Updated
Wed Oct 11 12:00:01 EDT 2006
nobody:*:-2:60001::/:
car:*,N19R:60001:101:Chris Robinson,ABC G7-2,648-8613,DXPC Port XX:/home/operator/car:/usr/bin/ksh
chrisr:NldKUA0cxhVyc,N1mR:60001:31000:Christopher Rupnik,Montreal,514-428-1516,DXPC Port 64:/home/chrisr:/usr/bin/ksh
fgagne:BXtjo5UYz5oiM,N1yQ:60001:31000:Frederic Gagne,Montreal,514 428-1531,DXPCPort 66:/home/fgagne:/usr/bin/ksh
dfc:GCimAKqaeVcL2,N1yQ:60001:20:Dewain Carroll,Atlanta ABC,404 648-5031,DXPC Port 69:/home/dfc:/usr/bin/ksh
nxsm:9pNVD/RpRIzoM,B2GR:60001:20:Nayef Smith,Atlanta ABC,648-5004,DXPC Port 49:/home/nxsm:/usr/bin/ksh
smrej:5YsUzb3lLXdZM,M1lR:60001:20:Richard Jones,Atlanta,648-7920,DXPC Port 616:/home/smrej:/usr/bin/ksh
jacksros:rAE6bUKYG6lRE:60001:30000:Ross Jackson,Blackburn,61 03 88772558,:/home/hpatlsys/jacksros:/usr/bin/ksh
dwarampu:WN57Ug2ATQzO2:60001:30000:Siva Satya Prasad Reddy Dwarampudi,Bangalore,91 80 26185026,:/home/hpatlsys/dwarampu:/usr/bin/sh
twalker:B9UBji.HMgAEY:60001:30000:Thomas Walker,ATA,404 648 7405,:/home/hpatlsys/twalker:/usr/bin/sh
ullahs:GBPNkOJ0fBhdc,ZRZR:60001:30000:Sibghat Ullah,Ontario,,:/home/hpatlsys/ullahs:/usr/bin/sh

Updated...

The UID got changed on October 11 2006 after 11.00 AM EST. But this is not consistent and we are not sure when this will happen again.

This is the 4th incident this year.

I have lot of points with me to award you for the best FIX. :-)

Let me know if you need any further details for investigation.

Thanks and regards,
Vinod

[vinod_25]

Hi Champs,

Why i feel UID's above 65535 an issue is bcoz... I read

UID 0 The superuser (aka root).

UID -2 NFS 'nobody'. Note that because uid_t is unsigned, -2 is mapped to the special value 60001 by NFS.

UID 60001 and 60002 For historical reasons, these values correspond to the users ``nobody'' and ``noaccess'', respectively. It is recommended that you not allocate these values to real users.

Conventions:

UID 1 to 10 Commonly used for system pseudo users and daemons.

UID 11 to 99 Commonly used for uucp logins and 'famous users'.

UID 100 to 2147483647 (except for 60001 and 60002)Normal users (start at 100). For historical reasons certain operations are restricted for uids larger than 65535.

[Robert-Jan Goossens]

Hi Vinod,

This could be a corruption in the passwd/group file.

Try running

# pwck
# grpck

Starting from 11.0 there is also a password and group hashing and caching daemon (pwgrd, /var/spool/pwgr). I don't know if you have restarted the server in between these events, but you could reset this daemon.

# ps -ef | grep pwgrd
# kill PID
# /usr/sbin/pwgrd

After restarting the daemon will rebuild the cache files.

Hope this helps,
Robert-Jan

[vinod_25]

Hi Bob,

Thank you for your prompt reply.

i have run pwck and found a list of users with Login directory not found. Those users are not provided with login directory intendedly.

grpck didnot return any error.

and regardign pwgrd - the server has been restarted several times during the last week several times for patching... hence the pwgrd is new with cache updates.

But the problem is still persistent. We are missing something to get the BUG.

I have read recently on one article that if user logins through XDM then the login ID's above 60000 are reset to 60001. There should be something of this kind happening... I guess... but what is XDM and how to trace those 10 users or any of the user in /etc/passwd access this box through XDM; I am unaware... if anyone can help me on this stuff too... will be of great help...

Points awarded as per the scheme :)

Regds
Vinod

[Robert-Jan Goossens]

Hi Vinod,

XDM (XDMCP) X-display Display Manager (control protocol) = part of CDE (Common Desktop Environment)

Search the patch database for CDE patches, and compare the versions with the ones installed on your server.

http://www2.itrc.hp.com/service/patch/search.do?BC=main|&pageOsid=hpux

Regards,
Robert-Jan

[vinod_25]

Hi Champs,

Please help me resolve this issue...

Major headache in our environment bcoz of this...

See I am very good at assigning points

regds,
Vinod

[vinod_25]

Hi Unix Champs,

Help me... awaiting sloutions from you all...

regds,
Vinod

[vinod_25]

Hi Champs,

Pls help

regds,
Vinod