Visit Our UNIX and Linux User Community


/var/log/wtmp SuSE log permission rollback

 
Thread Tools Search this Thread
Homework and Emergencies Emergency UNIX and Linux Support /var/log/wtmp SuSE log permission rollback
# 1  
Old 01-10-2011
/var/log/wtmp SuSE log permission rollback

Hello All, On my SuSE system, I have wtmp log this log file permission is 644 but every reboot the file permission rollback to 664. In the logrotate.conf and logrotate.d/wtmp files the wtmp logrotate set to 644. I would like to know, which "file" or "script" modify the wtmp log to rollback to 664 permission at all reboot times? /var/log/wtmp SuSE Server 10 SP3 log permission rollback???
# 2  
Old 01-10-2011
Before you get your wish, make sure you will enjoy it! Maybe some process of a user in the file's current group is logging in it?

Which users are in the file's group?

Can you change the file's group to one with no members?

Sometimes, it is easier to add your own chmod to the end of the boot scripts, so the exposure is momentary and before users become active.
# 3  
Old 01-10-2011
Quote:
Originally Posted by DGPickett
Before you get your wish, make sure you will enjoy it! Maybe some process of a user in the file's current group is logging in it?

Which users are in the file's group?

Can you change the file's group to one with no members?

Sometimes, it is easier to add your own chmod to the end of the boot scripts, so the exposure is momentary and before users become active.
There is nobody in the utmp group.

Yes there is easier to add line to the boot scripts, but I would like to find which line have been change the argumentum again and again. I have the solution, but I have not found the cause Smilie

On RedHat in the sysinit file there is a line:

chmod 664 /var/log/wtmp, but I would like to found a same on SuSE :S
# 4  
Old 01-11-2011
Can you move it to another path, maybe with a sym link? Maybe something is hitting it with a wild card or recursively by accident. A sym link is ignored on chmod recursion, but not by wild cards.
# 5  
Old 01-12-2011
Quote:
Originally Posted by DGPickett
Can you move it to another path, maybe with a sym link? Maybe something is hitting it with a wild card or recursively by accident. A sym link is ignored on chmod recursion, but not by wild cards.
I cannot modify the settings on the server, I need to explain this violation for my Boss, but I did not found the cause in the rc.script, I have used grep for all /etc Smilie
# 6  
Old 01-12-2011
Post rewrite. Found out what is changing the permissions on startup.

See /etc/permissions* (Filename executed varies according to the value in /etc/sysconfig/security). Comments in the file explain it all and what runs the script on startup.
http://gitorious.org/opensuse/permis...b1/permissions

Last edited by methyl; 01-12-2011 at 12:52 PM.. Reason: Stop press: More Stop press,
# 7  
Old 01-12-2011
I guess it is a prophylactic reset of critical permissions on every boot.

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Transfer the logs being thrown into /var/log/messages into another file example /var/log/volumelog

I have been searching and reading about syslog. I would like to know how to Transfer the logs being thrown into /var/log/messages into another file example /var/log/volumelog. tail -f /var/log/messages dblogger: msg_to_dbrow: no logtype using missing dblogger: msg_to_dbrow_str: val ==... (2 Replies)
Discussion started by: kenshinhimura
2 Replies

2. Shell Programming and Scripting

Log all the commands input by user at real time in /var/log/messages

Below is my script to log all the command input by any user to /var/log/messages. But I cant achieve the desired output that i want. PLease see below. function log2syslog { declare COMMAND COMMAND=$(fc -ln -0) logger -p local1.notice -t bash -i -- "$USER:$COMMAND" } trap... (12 Replies)
Discussion started by: invinzin21
12 Replies

3. SuSE

Non root user want to see /var/log/messages - any suse equivalent of Solaris dmesg

Hi New to Suse - mainly used Solaris. In solaris dmesg will also show you contents of messages log file but in Suse Liux it doesnt appear to. I dont have root access to this Suse server, and wondering is there any other tool / utility that allows me to see the messages file contents like on... (1 Reply)
Discussion started by: frustrated1
1 Replies

4. HP-UX

Script to monitor /var/opt/resmon/log/event.log file

AM in need of some plugin/script that can monitor HP-UX file "/var/opt/resmon/log/event.log" . Have written a scrip in sh shell that is working fine for syslog.log and mail.log as having standard format, have interrogated that to Nagios and is working as I required . But same script failed to... (3 Replies)
Discussion started by: Shirishlnx
3 Replies

5. Shell Programming and Scripting

How can view log messages between two time frame from /var/log/message or any type of log files

How can view log messages between two time frame from /var/log/message or any type of log files. when logfiles are very big and especially many messages with in few minutes, I would like to display log messages between 5 minute interval. Could you pls give me the command? (1 Reply)
Discussion started by: johnveslin
1 Replies

6. Solaris

Difference between /var/log/syslog and /var/adm/messages

Hi, Is the contents in /var/log/syslog and /var/adm/messages are same?? Regards (3 Replies)
Discussion started by: vks47
3 Replies

7. AIX

/var/adm/wtmp - few entries & huge size.

Hi all. I have a strange case on one of my AIX boxes. /var/adm/wtmp on server01 is ~ 400MB large but it only has ~1200 lines. For example on server02 there are ~85000 lines and the file is ~158MB large. I check lines through 'last | wc -l'. But when I check line directly with 'wc -l... (2 Replies)
Discussion started by: robroy
2 Replies

8. Solaris

diff b/w /var/log/syslog and /var/adm/messages

hi sirs can u tell the difference between /var/log/syslogs and /var/adm/messages in my working place i am having two servers. in one servers messages file is empty and syslog file is going on increasing.. and in another servers message file is going on increasing but syslog file is... (2 Replies)
Discussion started by: tv.praveenkumar
2 Replies

9. AIX

Impacts of emptying /var/adm/wtmp file ?

In our operating procedures, if a workstation has a space problem in the /var filesystem, one of the most frequent case we were told is the size of the /var/adm/wtmp file. Someone once told me it is dangerous to do this. Is it ? I cannot say for certain that whomever wrote that procedure is... (2 Replies)
Discussion started by: Browser_ice
2 Replies

10. Red Hat

changing wtmp ownership and permission

Hi, I am using redhat AS 3. Recently, I was asked to implement a security control on the OS: to change ownership of /var/log/wtmp to root:sys and permission to 600. However, when I made the change and reboot the machine, everything was reverted. How come? Please help. The following is the... (1 Reply)
Discussion started by: voa2mp3
1 Replies

Featured Tech Videos