Unwanted processes belongs to UID 59999

[Bambang Lestari]

Hi All,

Recently in our development servers, HPUX 11i, there has been something fishy going on. There are a few times when I saw multiple duplicated processes (java processes) running under the userid 59999. Any idea who this user is? And how to get rid of this UID?

FYI, there is no such UID in our server setting/configuration.

Best Regards,
Bambang

[Wodisch]

Hello Bambang,

try a "find" on that user-id:

find / -user 59999 -exec ls -abdl {} ";"

Could be there are SUID codefiles owned by that user-id!

HTH,
Wodisch

[Steven Sim Kok Leong]

Hi,

Execute:

# grep 59999 /etc/passwd

A number of third-party software uses 59999 as the uid of their application logon.

Hope this helps. Regards.

Steven Sim Kok Leong
Brainbench MVP for Unix Admin
http://www.brainbench.com

[Bambang Lestari]

Hi Wodisch,

I tried the command as suggested, but found nothing. No such files.

Thanks,
Bambang

[Steven Sim Kok Leong]

Hi,

Try executing:

# find / -uid 59999 -exec ll {} \;

Hope this helps. Regards.

Steven Sim Kok Leong
Brainbench MVP for Unix Admin
http://www.brainbench.com

[Darrell Allen]

Hi Bambang,

The following little C code shows how a program can change uid to one that isn't even on the system.

#include

main ()

{

char *proc = "/usr/bin/id";

setuid(59999);
system(&proc[0]);

} /* end of program*/


If root runs the program (or suid bit is on the executable) the process will change uid to 59999 even if that doesn't exist on the system. The program doesn't have to be owned by 59999 so find would not help. And if you don't have the source code for it, grep nor strings will help.

I'm sorry, but I'm not proficient enough in programming to help further. HOpefully someone else will take it from here.

Darrell

[Mark Greene_1]

periodically run this:

UNIX95= ps -efH

and you'll be able to see the parent process(es).

--
mark