TCB problem: I found the culprit

From: Richard A. Muirden <richard_at_rmit.edu.au>
Date: Mon, 2 Jan 1995 22:10:34 +1100 (EDT)

Hi all,

it's me again.

After posting my note to you guys a few hours back regarding my TCB
problems, I think I've narrowed down the suspect, in fact I'm almost
sure of it. Here's what I did:

After a ton of trying lots of things out that didn't work (:( ) I
tried a copy of the /etc/passwd from last night (we keep nightly and
weekly copies of the password file for backup/security purposes). When
I used THIS as /etc/passwd, everything worked fine again. Woo Woo!

Thus: what were the differences? Well a diff gave me tons of junk
because:

a) when I ran the pwck program it found 20-30 users with bad directories
   and mangled shells (this resulted from a buggy programming effort of
   a month or so ago - no, don't ask :) ). I had fixed all of these, but
   the problem had surfaced before I ran pwck in the first place, so I
   discounted those

b) A colleague had logged in from home and per an announced plan had
   renamed several accounts, however I couldn't find anything amiss here.
   It *is* true that he forgot to also fix the tcb entries, which was
   a painfully tedius task for me to do, but again I didn't think this
   was the problem as I tried syncing what was in the password file with
   what was in the tcb, and the problem still existed.

So I decided it was something funny about a username, or a funny char
in the password file. So I decided to,revert every one of
the changed account id's back to what they were yesterday, and then
by a process of elimination find the dodgy entry.

I moved them all back (about 20 accounts in all). and hey presto, the
world was wonderful and bright - the tcb was back in sync !! Now, to
find the nasty problem userid! So I started changing users back, and
rebuilding the password files and checking the tcb. After a somewhat
lengthy time of doing this, I found it!

Here's the old line in the password file (this works):

rxkjfl:*:2078:1208:Jason Lu,Kay House Lab,x3663:/staff/rxx/rxxjfl:/bin/tcsh

however when he is changed to:

rxxjfl:*:2078:1208:Jason Lu,Kay House Lab,x3663:/staff/rxx/rxxjfl:/bin/tcsh
  ^

all hell breaks loose.

It isn't a duplicate userid, nor a username conflict - I checked
those.

It wasn't anything to do with the TCB files, because I tried having
a rxxjfl in the auth system, and it still barfed.

I can't work it out at all. As soon as I change that one x back to a k,
everything is wonderful!

I can't find any strange control chars, or any other line out of place
in the file, and it would seem that is the suspect one because of what
happens when I go from what it was, to the changed one.

very weird.

-richard
(happy that the TCB is back working again, but unhappy because he can't
 figure out what the heck the problem with the username is!)
 
-- 
Richard A. Muirden, Sys. Admin |Fan of Shostakovich, "Star Trek" and the Boeing
Mailto: richard_at_rmit.EDU.AU    |777 (launch: May 15, 1995 - United Airlines).  
Phone: (+61 3) 660 3814        |I created alt.fan.shostakovich! Fly: UA,QF,WN
http://www.rmit.edu.au/richard |Can *YOU* beat my 102 Shost CD's? :-)
Received on Mon Jan 02 1995 - 06:10:37 NZDT

This archive was generated by hypermail 2.4.0 : Wed Nov 08 2023 - 11:53:45 NZDT