Wrong username displayed for root when su'ed in.

[James A. Donovan]

Have a bizarre issue with one server. I will login to the system as myself (jdonovan) and su to root. If I then use ftp, the username prompt always shows as the user dchou.

220 hpcc929 FTP server (HP ASL ftpd, version(301)) ready.
Name (us-support.external.hp.com:dchou):

Similarly, if I send out e-mail's when su'ed into root, the receiver sees that e-mail as having been sent by "dchou". I found one reference to what I think may be the same issue, but there was no resolution.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,1150,0x011072106351d5118fef0090279cd0f9,00.html

I logged directly into the console as root and the system does NOT exhibit this behavior, so I'm thinking that the su command is doing something funky.

[Patrick Wallek]

When you su are you doing an 'su' or an 'su -'. If you aren't doing the 'su -' use that syntax. That makes sure all . files are processed.

[Volker Borowski]

Hi Jim,

as E-Mail and ftp to HP have to do with internet....

How does it behave on internal connections ?
Could it be that you have this only with outbound traffic, which runs through a proxy ?

Public ftp servers often expect you to login with your e-mail address. The proposal is made by a reverse auth-request or something like this.
Since it is doing an active connection (on seperate selfmade connection) the proxy is rarely able to reverse this request to the oringinator. But for root it has a match on its own box. Check out /etc/passwd on your proxy. I am curious, if you find your userid there...

Volker

[James A. Donovan]

...Am using 'su -'

...and no proxy servers involved anywhere. Ftp always shows the username as "dchou" when su'ed into the root account, regardless of where the ftp server is located.

[Patrick Wallek]

When I am logged in as root, and send e-mail it too show up with my regular log in id. But it is the correct ID.

I think the troulbe you have may be related to your UID in the /etc/passwd file. I would check the passwd file and look at your id and the other id and see if they have the same UID value. I bet they do and I bet the other ID comes first in the passwd file.

If you are using NIS or NIS+ check their passwd maps as well for a UID problem.

[James A. Donovan]

/etc/passwd was the very first place I checked....nothing wrong there. Root is 0, dchou is 2025, and I am 2001. Still when I (jdonovan) su to root all e-mail is "sent" by dchou, and all ftp session username prompts think dchou is logged in.

Commands like who, id, and ls -l report information correctly.

[Patrick Wallek]

What does su look like if you do an ll on it?

Here is mine from my 10.20 machine:

-r-sr-xr-x 1 root bin 20480 Feb 20 1998 /usr/bin/su

And here from an 11.0 machine:

-r-sr-xr-x 1 root bin 24576 Aug 6 1998 /usr/bin/su

The ownership or permissions of su haven't been changed hve they?

[James A. Donovan]

# ll `whence su`
-r-sr-xr-x 1 root bin 24576 Aug 6 1998 /usr/bin/su
# what `whence su`
/usr/bin/su:
$Revision: 82.15.1.1 $
PATCH_11_00: su.o 98/08/06

I also compared this to other 11.0 systems where things aren't acting strangely, and the su binary is identical on those machines. I've even replaced the binary with a copy from another box, and I still get the same behavior.

[Jim Turner]

Sorry in advance if you've already done this. Have you tried a "pwck" to make sure there's nothing wacko about the passwd file that would cause this unexplained operation?

[James A. Donovan]

both pwck and grpck returned nothing wrong....

[Volker Borowski]

Hi Jim,
another shot:

Does sendmail.cf contain "dchou" at any place ?
Does a .netrc file exist in / (ftp) ?

Any other /. files that may affect mail for root ?

Volker

[Robin Wakefield]

If you have a look at the source for ftp (util.c), the initial user prompt is the ORIGINAL person who logged into the terminal, i.e. a getlogin call.

Robin

[Tracey]

Any refrence to this person in the /etc/mail/aliases file, or possibly the username being redirected in the /.profile of root?

[Robin Wakefield]

Reference my previous reply, if you issue a "who am i" command, what's it come back with?

It could be that your /var/adm/utmp & wtmp files are corrupt.

Robin.

[James A. Donovan]

Volker---
# cat /etc/mail/sendmail.cf | grep dchou
#
Additionally, no .netrc file or any other file which could cause such an effect.


Robin----
# who am i
jdonovan pts/1 Jun 29 12:17

Again, commands like this correctly show who is logged in. It is ONLY when I use su to login to root that this behavior occurs.


I've tried recreating the /etc/utmp file, but that had no effect.

[Mark Vollmers]

I don't know if you've tried this, but what does it do when you su to other users? Does it do the same thing? what about if you log in as another user and su to root? Maybe it is something with your account specifically? Just guessing.

mark

[James A. Donovan]

May be starting to get somewhere....

I create a user called "temp", then used su to connect to it from my jdonovan account. It exhibited the same behavior with ftp as when I su to root.

$ who am i
jdonovan pts/1 Jul 2 11:16
$ id
uid=3103(temp) gid=20(users)
$ ftp firebird
Connected to firebird.playstation.sony.com.
220 firebird FTP server (Version wu-2.6.0(2) Wed Dec 15 15:42:55 GMT 1999) ready
.
Name (firebird:dchou):


Also, logging in directly as the user temp and using su to switch to root, I see the expected behavior!

# who am i
temp pts/2 Jul 2 13:27
# id
uid=0(root) gid=3(sys) groups=0(root),1(other),2(bin),4(adm),5(daemon),6(mail),7
(lp),20(users)
# ftp firebird
Connected to firebird.playstation.sony.com.
220 firebird FTP server (Version wu-2.6.0(2) Wed Dec 15 15:42:55 GMT 1999) ready
.
Name (firebird:root):

[Volker Borowski]

Jim,
this looks very strange indeed.
My HP-UX 11.00 system behaves just the other way round (suggesting the who-user, not the id-user):

# who am i
root pts/ta Jul 3 09:23
# id
uid=3200(sqde30) gid=101(sapsys) groups=200(dba)
# ftp wowsol01
Connected to wowsol01.
220 wowsol01 FTP server (SunOS 5.7) ready.
Name (wowsol01:root):

Did you check "which ftp" in "login" and "su -" session ? I assumed, that this should be the same, but I just reread "man su" and was wrong. While "login" starts to execute profiles with an empty "PATH", "su -" already has "/usr/bin" set (there is an ftp in /usr/bin). So if your profiles go like

PATH=$PATH:....

something might be diffrent !

[ I do not think this one will score, but what will you do other than speculate on this ]

Good hunting
Volker

[Pete Ellis]

Is it not just a case of some binaries using logname to access the user, when you su to a user your logname is still the name you logged in with. See the command 'logname' it uses get_login to get your user name and not the variable LOGNAME. 'who am i' & 'whoami' give different output. Very confusing, but I expect that as different binaries have been produced a consistant method of accessing the logname/user name has not been used. It could even be possible that patches could introduce more differences! no change there!!

[Pete Ellis]

I have just tried this on a solaris system and its the same

[Chris Calabrese · Accepted solution]

I'm guessing that Robin Wakefield's assessment is correct and your wtmp/utmp files are screwed up.

One other question before I decide that for sure though... How are you logging into the system? If you're rsh/remsh-ing in and running an xterm/dtterm without the -l flag, your session may not be getting logged in utmp/wtmp.