1

In my Solaris server (SunOS 5.10) shadow files are getting created automatically every 10 minutes for two particular users in /etc.

The content of the files is the same as /etc/shadow. Say john and ron are two users, then the files will be created every 10 minutes as shadow_john_1404011142 and shadow_ron_1404011142(where 1404011142 is the current time the next file will be there with 1404011152). How do I kill the process which is creating those files?

1

I will infer that the last sentence means "How do I kill find the process which is creating those files [so I can kill it]?"

Let's assume the permissions of the system's /, /etc and /etc/shadow directories and files are normal, something like:

# ls -ld /
drwxr-xr-x  31 root     root        1024 Sep 30 13:26 /
# ls -ld /etc
drwxr-xr-x  76 root     sys          215 Oct 28 23:05 /etc
# ls -al /etc/shadow
-r--------   1 root     sys          294 Oct 15 16:09 /etc/shadow
# 

I.e. only root can create files in /etc and can read /etc/shadow, then the process creating the files has to have root privileges in order to read the /etc/shadow file and create the copies (a cross-check on this is whether the copies of /etc/shadow are owned by root).

This is not normal behavior in a Solaris system. My first wild-ass guess (not even a SWAG), based on the regularity of the occurrence, is that there is a root crontab entry or user crontab entry with elevated privileges doing this for some odd reason. Maybe some ad hoc password synchronization. If so, killing it is just commenting out the crontab entry (assuming that you still want to do it after finding out more). My second guess is that this is a zone and the crontab entry doing this is in the global zone. In which case you are, and should be, SOL. My third suggestion is to monitor the /etc directory with dtrace and attempt to catch the process in the act. How to do that is another question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.