username not shown in ps -ef output

[NDO]

hi all!

Please can some help on this one.
Somebody must have changed something, what is happening is that when "ps -ef" it does not show the owner of the process, it onlys shows the the user ID,which is a problem for us because we have an application that has its own user to start it up. Please can somebody help?

Fernando

[James R. Ferguson]

Hi Fernando:

> it does not show the owner of the process, it only shows the the user ID,

This suggests that either (1) the user (account) has been deleted from the system after the process was started; or (2) the permissions of '/etc/passwd' are not world-readable.

Verify your '/etc/passwd' file contains an entry for the 'uid' associated with the process and that the file is world-readable.

Regards!

...JRF...

[NDO]

Hi!

Unfortuately its not only processes owned by a particular user that are not shown in the ps -ef. Even processes owned by root or any user, look below at one listing:
mpecu007[344] / # ps -ef | more
23y0C UID PID PPID C STIME TTY TIME
COMMAND
0 0 0 0 Jan 19 ? 140:15 swapper
0 1 0 0 Jan 19 ? 4:40 init
0 2 0 0 Jan 19 ? 164:01 vhand
0 3 0 0 Jan 19 ? 1893:44 statdaemon
0 4 0 0 Jan 19 ? 9:17 unhashdaemon
0 8 0 0 Jan 19 ? 352:41 supsched
0 9 0 0 Jan 19 ? 0:00 strmem
0 10 0 0 Jan 19 ? 0:00 strweld
0 11 0 0 Jan 19 ? 0:00 strfreebd
0 12 0 0 Jan 19 ? 0:12 ttisr
0 18 0 0 Jan 19 ? 97:44 lvmkd
0 19 0 0 Jan 19 ? 99:28 lvmkd
0 20 0 0 Jan 19 ? 92:07 lvmkd
0 21 0 0 Jan 19 ? 96:19 lvmkd
0 22 0 0 Jan 19 ? 87:41 lvmkd
0 23 0 0 Jan 19 ? 94:18 lvmkd
0 24 0 0 Jan 19 ? 0:00 lvmschedd
305 27349 27347 0 Jan 29 pts/0 0:00 /csh_ceexec
305 27965 1 0 May 5 ? 0:00 /usr/dt/bin/dtexec -open 0 -ttpr
ocid 2.1A06oT 01 27938 13421
0 29 0 0 Jan 19 ? 933:24 vxfsd
305 331 1 0 Apr 29 ? 0:00 /usr/dt/bin/dtterm


Any hints in what could be wrong?

Fernando

[James R. Ferguson · Accepted solution]

Hi (again) Fernando:

Verify that your '/etc/passwd' hasn't been truncated (to a size of zero).

Regards!

...JRF...

[NDO]

Ok, I'll check that, I'm already at home now, and I do not have access from home, I'll let you know tomorrow

Regards

Fernando

[Bill Hassell]

user names are stored in only one place: /etc/passwd. For programs like ps and ll, the user ID (number) is translated to a user name for convenience. The UID number is still the same and processes should run correctly unless there is code that relies on the translated user name. Since /etc/passwd contains the user names, someone may have tried to "improve" security by taking away read permission for /etc/passwd. Or worse, the file has been corrupted with bad editing. As soon as possible open a couple of root logins as asses the damage.

[Dennis Handly]

Are you using NIS? If so, then a failure there would suppress those UIDs. But it seems that root is also suppressed. So your passwd file is bad. Is pwgrd(1M) running?
What OS version are you running?

[Kapil Jha]

Ur ps -ef output shows numbers (0,30..) in UID colums that means its showing uid not username.

What does ps -elf shows.

and yes check passwd file if its intact.

Better u don't log out a root session.

BR,
Kapil+

[NDO]

hi the passwd file has size 854, it looks ok, but if I type whoami at prompt it shows Intruder alert. I will be posting the passwd file soon. Fernandi

[Kapil Jha]

don post passwd file if it has encrypted passwd :)

what does id command shows.

BR,
Kapil+

[johnsonpk]

Check the integrity of passwd file by running pwck

Also post the permission of /etc/passwd and contents of /etc/nsswitch.conf file

[NDO]

Hi, All

For some reason everthing is back to normal, that is before I run the pwck comand which the output is:mpecu007[389] /tmp # pwck > /tmp/pwck.out

smbnull:*:101:101:DO NOT USE OR DELETE - needed by Samba:/home/smbnull:/sbin/sh
Login directory not found

postgres:*:378:20:PostgresSQL,,,:/usr/local/pgsql:/usr/bin/sh
Login directory not found
.........................................

The paswwd file is not encrypted, please find attached the file.

But I'm a bit nervous because now everthing is fine, ps -ef it does show the username, and the whoami comand shows me root.
Please can you give me some hints.

Fernando

[Dennis Handly]

>the whoami com and shows me root.

Did you su from root?

[NDO]

Yes, I was root.

Fernando

[James R. Ferguson]

Hi (again):

You have yet to verify that the permissions of your '/etc/passwd' file are "-r--r--r--".

Regards!

...JRF...

[NDO]

Hi all!

Thank you very for your contributions, I appreciate your help, but now I'm gonna have to close this thread and assign some points to all you.

Thank you

Bye

Fernando

[NDO]

thank you all

Fernando

[James R. Ferguson]

Hi (again) Fernando:

> but now I'm gonna have to close this thread and assign some points to all you.

That's very nice, but more importantly exactly *what* caused your problem?

Regards!

...JRF...