Which process/script is locking account ?

Login or Register to Ask a Question and Join Our Community

Which process/script is locking account ?

Tags

Login to Discuss or Reply to this Discussion in Our Community

Operating Systems Solaris Which process/script is locking account ?

09-24-2015

Registered User

576, 19

Join Date: Mar 2011

Last Activity: 22 April 2020, 4:52 PM EDT

Posts: 576

Thanks Given: 83

Thanked 19 Times in 16 Posts

Which process/script is locking account ?

There is a account - ohsuser on Solaris-10 zone. It is getting locked every 2-3 minutes. Can I know, what is process or script, which is using this account and locking it ?

Code:

root@tswsd23-prdt01:/root# cat /var/adm/messages | tail -10
Sep 24 11:05:53 tswsd23-prdt01 nmo[24030]: [ID 903112 auth.notice] Excessive (3) login failures for ohsuser: locking account.
Sep 24 11:06:01 tswsd23-prdt01 nmo[24068]: [ID 903112 auth.notice] Excessive (3) login failures for ohsuser: locking account.
Sep 24 11:06:11 tswsd23-prdt01 nmo[24071]: [ID 903112 auth.notice] Excessive (3) login failures for ohsuser: locking account.
Sep 24 11:07:29 tswsd23-prdt01 nmo[24209]: [ID 903112 auth.notice] Excessive (3) login failures for ohsuser: locking account.
Sep 24 11:07:32 tswsd23-prdt01 nmo[24212]: [ID 903112 auth.notice] Excessive (3) login failures for ohsuser: locking account.
Sep 24 11:10:47 tswsd23-prdt01 nmo[25404]: [ID 903112 auth.notice] Excessive (3) login failures for ohsuser: locking account.
Sep 24 11:10:51 tswsd23-prdt01 nmo[25408]: [ID 903112 auth.notice] Excessive (3) login failures for ohsuser: locking account.

solaris_1977

View Public Profile for solaris_1977

Find all posts by solaris_1977

09-24-2015

Registered User

4,940, 703

Join Date: Dec 2007

Last Activity: 4 October 2020, 5:57 PM EDT

Location: Outside Paris

Posts: 4,940

Thanks Given: 20

Thanked 703 Times in 595 Posts

The process is "nmo", possibly a binary used by an OEM agent.

jlliagre

View Public Profile for jlliagre

Find all posts by jlliagre

09-24-2015

Registered User

576, 19

Join Date: Mar 2011

Last Activity: 22 April 2020, 4:52 PM EDT

Posts: 576

Thanks Given: 83

Thanked 19 Times in 16 Posts

Yes, seems like somebody places this user hardcoded somewhere in OEM agent script. But I am not able to figure out, where is that. Even application team is also trying to know, but no luck.
grepping nmo in ps doesn't return any output.

PHP Code:


root@tswsd23-prdt01:/root# ps -ef | grep -i ohsuser | wc -l
      21
root@tswsd23-prdt01:/root# ps -ef | grep -i nmo
    root 25934 25924   0 12:56:53 pts/3       0:00 grep -i nmo
root@tswsd23-prdt01:/root#

solaris_1977

View Public Profile for solaris_1977

Find all posts by solaris_1977

09-24-2015

Registered User

4,940, 703

Join Date: Dec 2007

Last Activity: 4 October 2020, 5:57 PM EDT

Location: Outside Paris

Posts: 4,940

Thanks Given: 20

Thanked 703 Times in 595 Posts

Time for some dtrace scripting. This will quickly tell you who is launching "nmo":

Code:

#!/usr/sbin/dtrace -qs

proc:::exec
{
  self->parent=stringof((unsigned char*)curpsinfo->pr_psargs);
}

proc:::exec-success
/self->parent != NULL && execname == "nmo"/
{
  printf("%s -> %s\n",self->parent,curpsinfo->pr_psargs);
}

proc:::exec-success, proc:::exec-failure
{
  self->parent=NULL;
}

jlliagre

View Public Profile for jlliagre

Find all posts by jlliagre

09-24-2015

Registered User

576, 19

Join Date: Mar 2011

Last Activity: 22 April 2020, 4:52 PM EDT

Posts: 576

Thanks Given: 83

Thanked 19 Times in 16 Posts

Am I running it wrongly ? I am running it on non-global zone

Code:

root@tswsd23-prdt01:/root# /tmp/dt_scr.sh
dtrace: failed to compile script /tmp/dt_scr.sh: line 3: probe description proc:::exec does not match any probes
root@tswsd23-prdt01:/root# /tmp/dt_scr.sh nmo
dtrace: failed to compile script /tmp/dt_scr.sh: line 18: extraneous argument 'nmo' ($1 is not referenced)
root@tswsd23-prdt01:/root#
 root@tswsd23-prdt01:/root# cat /tmp/dt_scr.sh | wc -l
      17
 root@tswsd23-prdt01:/root#

Last edited by solaris_1977; 09-24-2015 at 07:47 PM..

solaris_1977

View Public Profile for solaris_1977

Find all posts by solaris_1977

09-24-2015

Registered User

4,940, 703

Join Date: Dec 2007

Last Activity: 4 October 2020, 5:57 PM EDT

Location: Outside Paris

Posts: 4,940

Thanks Given: 20

Thanked 703 Times in 595 Posts

It must be run from the global zone.

jlliagre

View Public Profile for jlliagre

Find all posts by jlliagre

Login or Register to Ask a Question

Previous Thread | Next Thread

9 More Discussions You Might Find Interesting

1. How to Post in the The UNIX and Linux Forums

Simultaneously try to execute commands after connecting to remote account to one account

I have made password less connection to my remote account. and i tried to execute commands at a time. but i am unable to execute the commands. ssh $ACCOUNT_DETAILS@$HOST_DETAILS cd ~/JEE/*/logs/

2. Shell Programming and Scripting

script to monitor process running on server and posting a mail if any process is dead

Hello all, I would be happy if any one could help me with a shell script that would determine all the processes running on a Unix server and post a mail if any of the process is not running or aborted. Thanks in advance Regards, pradeep kulkarni. :mad:

3. AIX

Trace the process responsible for locking filesystem ?

Hi, Sometimes when I want to unmount some filesystem I get "The requested resource is busy." error. In such a case I try to find and kill process that uses that filesystem. I do that on random. Is there a right way to find whitch prosesses use filesystem resource at given time ? thanks...

4. Shell Programming and Scripting

Locking a script

Hello everyone Im sure this has been asked lots of times before, but after endless searching i cant find what i need. How can i make a bash script unreadable to all, including root, but still executable, im not worried about editing it again etc... , is there a way to convert it or something, i...

5. Shell Programming and Scripting

Locking specific account without using passwd

Hey guys just wondering how i could lock a specific acount by prepending LK to the password field in the /etc/shadow file. it cannot be done through a command since the script gets called by a menu driven interface so i cant use "passwd". Is there a way where i can search for a specific account...

6. UNIX for Dummies Questions & Answers

How to change the system account that a process is running on?

I'm running an Apache server on Ubuntu. When I try to call fopen() in PHP, I get a bunch of permission errors. I searched for advice on this, and I found that I needed to change the system account that Apache runs on. However, I'm not sure how to do this, and I was unable to find the answer on...

7. Solaris

Solaris 10 Kerberos with local account locking

Hello Gurus, I desperately need help to replicate the functionality that I had with Solaris 8 and SEAM into Solaris 10. Our application needs a few users which are created with the application install. One of our customer requires Kerberos as single sign-on because of their IT department...

8. Solaris

ftp account locking

I need some help trying to figure out why our ftp account keeps getting locked with no manual intervention. We have end of day processes that run nightly and the last thing it does is ftp files to a server. Everyonce in a while the script fails because the account has been locked. How could this...

9. Solaris

solari s 10 auto account locking

does anyone know in solaris 10, can you lock an account if the user does not change their password within a certain amount of time? What i want to do is, if a user doesnt change their password within 90 days, i want the account locked. This is similar to the redhat linux passwd -i command. ...

Login or Register to Ask a Question