Very confusing /etc/passwd problem

[Ronelle van Niekerk]

OK, I don't want to get into details of how I did it, but I removed the passwd file by mistake.

I restored a version from Saturday - using omniback - and came across a whole lot of problems:

1) The file restored with the wrong permissions
3) The group file went missing until I stopped the pwgrd process
4) One, and only one, of the users was missing from the passwd file.

I tried all sorts of things, gave up and asked that user to log off the system. I restored again and it restored perfectly - right permissions and all users.

So is it because the user was logged into the system or is it becasue the pwgrd process was running? or both?

I've started the pwgrd process again - because it seems that it was running before.

Any help will be appreciated, although I hope I don't do this again!

-Ronelle

[Massimo Bianchi]

Hi,
since pwgrd is a passord and group cacher, i suspect that it holds some locks on that file, and in unix you can delete files while other program held them...


Check in this link:

http://www5.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000063236235

problems and issues are very similar.

If you are interested, do a search with pwgrd in the forum, you will see many other interesting docs.


Massimo

[Ronelle van Niekerk]

Thanks for that, i did do a search - which is why I stopped the pwgrd process.

But that user was still missing after I stopped the process.
It only came back when I restored the file again after the user was logged out.

Any ideas on that?

[Steven E. Protter]

In HP-UX 11.00 the /etc/group file can be reduced to zero bytes if the / root filesystem gets full.

I would restore the file again without that process and then run.

pwck

to check the /etc/passwd file

I'd also restore /etc/group from the same backup and run

grpck

To check that /etc/group

It's always best to do restores with as little software running as possible.

No file, program or application is supposed to affect the /etc/passwd and /etc/group file that way. Any program that does is a security hazard.

SEP