Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Recently I was asked to look at a system for a "friend" that left me completely stumped. Their original problem stated to me:

  1. They have a RHEL 5.10, gnome desktop fairly typical install
  2. They are having trouble running a Retina scan
    • They claim Retina could not ssh in and start the scan

This is what I found, after checking out their firewall, tcp wrappers, sshd config, sudoers, etc.

Any command you run that references a user appears to always reference root instead. Some examples:

  • desktop login as user 'scan' & you are actually logged in as root
  • ssh login does the same thing. whoami and who am i both return root
  • run chown -R scan.scan /home/scan results in all file ownerships to be = root:scan

There are no sticky bits set on programs in /usr/bin or /bin or /sbin other than what one would normally expect to see.

This problem is so odd, I don't even know what search terms to use.

Half-baked ideas welcome.

@Matthew Ife: The user id of scan is 501, but getent passwd scan returns:

scan:x:0:0::/home/scan:/bin/bash
share|improve this question
    
What is the user id of 'scan'? EDIT, also if possible, provide the output of getent passwd scan –  Matthew Ife Mar 27 at 19:48
2  
It sounds like several users share user ID zero. –  David Schwartz Mar 27 at 20:17
    
@David: Yes, I found two other accounts with the user id=0. I would like to know how that happened. What I am hoping is that a naive person simply edited /etc/passwd. –  DaveParillo Mar 27 at 20:37
add comment

1 Answer 1

up vote 8 down vote accepted

The user ID of scan is set to 0 (root).

Check if /etc/passwd contains two entries for scan. One mapped to root.

Otherwise, if you are using any other name services check that these dont export scan as UID 0.

And make sure you tell these people mapping multiple accounts to the same UID is not a good idea as you break the separation of privileges you would normally expect.

share|improve this answer
    
Thanks! Yeah - already said that was a big "no-no". I think they are only using local authentication. When you say "other name services", I presume you mean ldap, kerberos, etc? –  DaveParillo Mar 27 at 20:20
    
NIS, SSSD, LDAP basically, yeah. –  Matthew Ife Mar 27 at 20:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.