Recently I was asked to look at a system for a "friend" that left me completely stumped. Their original problem stated to me:

  1. They have a RHEL 5.10, gnome desktop fairly typical install
  2. They are having trouble running a Retina scan
    • They claim Retina could not ssh in and start the scan

This is what I found, after checking out their firewall, tcp wrappers, sshd config, sudoers, etc.

Any command you run that references a user appears to always reference root instead. Some examples:

  • desktop login as user 'scan' & you are actually logged in as root
  • ssh login does the same thing. whoami and who am i both return root
  • run chown -R scan.scan /home/scan results in all file ownerships to be = root:scan

There are no sticky bits set on programs in /usr/bin or /bin or /sbin other than what one would normally expect to see.

This problem is so odd, I don't even know what search terms to use.

Half-baked ideas welcome.

@Matthew Ife: The user id of scan is 501, but getent passwd scan returns:

  • What is the user id of 'scan'? EDIT, also if possible, provide the output of getent passwd scan – Matthew Ife Mar 27 '14 at 19:48
  • 2
    It sounds like several users share user ID zero. – David Schwartz Mar 27 '14 at 20:17
  • @David: Yes, I found two other accounts with the user id=0. I would like to know how that happened. What I am hoping is that a naive person simply edited /etc/passwd. – DaveParillo Mar 27 '14 at 20:37

The user ID of scan is set to 0 (root).

Check if /etc/passwd contains two entries for scan. One mapped to root.

Otherwise, if you are using any other name services check that these dont export scan as UID 0.

And make sure you tell these people mapping multiple accounts to the same UID is not a good idea as you break the separation of privileges you would normally expect.

| improve this answer | |
  • Thanks! Yeah - already said that was a big "no-no". I think they are only using local authentication. When you say "other name services", I presume you mean ldap, kerberos, etc? – DaveParillo Mar 27 '14 at 20:20
  • NIS, SSSD, LDAP basically, yeah. – Matthew Ife Mar 27 '14 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.