2

Recently I was asked to look at a system for a "friend" that left me completely stumped. Their original problem stated to me:

  1. They have a RHEL 5.10, gnome desktop fairly typical install
  2. They are having trouble running a Retina scan
    • They claim Retina could not ssh in and start the scan

This is what I found, after checking out their firewall, tcp wrappers, sshd config, sudoers, etc.

Any command you run that references a user appears to always reference root instead. Some examples:

  • desktop login as user 'scan' & you are actually logged in as root
  • ssh login does the same thing. whoami and who am i both return root
  • run chown -R scan.scan /home/scan results in all file ownerships to be = root:scan

There are no sticky bits set on programs in /usr/bin or /bin or /sbin other than what one would normally expect to see.

This problem is so odd, I don't even know what search terms to use.

Half-baked ideas welcome.

@Matthew Ife: The user id of scan is 501, but getent passwd scan returns:

scan:x:0:0::/home/scan:/bin/bash
3
  • What is the user id of 'scan'? EDIT, also if possible, provide the output of getent passwd scan Mar 27, 2014 at 19:48
  • 2
    It sounds like several users share user ID zero. Mar 27, 2014 at 20:17
  • @David: Yes, I found two other accounts with the user id=0. I would like to know how that happened. What I am hoping is that a naive person simply edited /etc/passwd. Mar 27, 2014 at 20:37

1 Answer 1

8

The user ID of scan is set to 0 (root).

Check if /etc/passwd contains two entries for scan. One mapped to root.

Otherwise, if you are using any other name services check that these dont export scan as UID 0.

And make sure you tell these people mapping multiple accounts to the same UID is not a good idea as you break the separation of privileges you would normally expect.

2
  • Thanks! Yeah - already said that was a big "no-no". I think they are only using local authentication. When you say "other name services", I presume you mean ldap, kerberos, etc? Mar 27, 2014 at 20:20
  • NIS, SSSD, LDAP basically, yeah. Mar 27, 2014 at 20:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .