[comp.sys.hp] A problem with /bin/login...keeps corrupting /etc/utmp

greg@cityzoo.acs.umbc.edu (Greg Sylvain,Lib 007a,3929,) (07/05/90)

	Hello again,

	I recently upgraded to 7.0 and I'm still having some problems.  First 
off, I should tell you it's a 7.0 tape that I got from a friend of mine who got
her tape back in Feburary. (Hp still hasn't shipped ours, and I couldn't wait 
until it came in the mail.  Too much other stuff that hinged on 7.0 was waiting
for it.)  My friend said that the 3 patches had allready been integrated into 
the tape. And in fact the HP S/W person was able to confirm that.  

	But I still have the problem where /bin/login won't let anyboy loggin. 
Sometimes it will let you remsh over, but that's rare.  And it turns out that 
if you delete /etc/utmp and then try it, you can get in. Also, the check sum 
is way of (my sum of /bin/login is :50122 200 /bin/login) what the normal sum
should be, something like 60000 or so. The person I got the tape from said she
had a similar problem after she installed, but it `went away'.  Does any one 
have a clue ? 

	Thanks alot,
	greg

	(i'm running 7.0 on a hp9000s300 machine)
				Greg Sylvain
				Academic Computing Services
				Systems Programmer
			
	UUCP:           	...!{uunet}!umbc5!greg
	Internet (Arpa) :	greg@umbc5.umbc.edu
 	BITNET :		GREGS@UMBC

tomg@hpcvlx.cv.hp.com (Thomas J. Gilg) (07/06/90)

> 	But I still have the problem where /bin/login won't let anyboy loggin. 
> Sometimes it will let you remsh over, but that's rare.  And it turns out that 
> if you delete /etc/utmp and then try it, you can get in. ................... 

The format of utmp has changed for 7.0, and pre 7.0 programs that modify
utmp/wtmp/btmp need to be updated.  Some programs to watch out for include:

    /bin/login
    /bin/su
    /etc/getty

    /usr/bin/X11/hpterm
    /usr/bin/X11/xterm

If you do a fairly complete update, you should take care of the old
utmp programs.

Thomas Gilg
tomg@cv.hp.com

rodean@hpfcdc.HP.COM (Bruce Rodean) (07/06/90)

In article <3569@umbc3.UMBC.EDU> greg@cityzoo.acs.umbc.edu (Greg Sylvain,Lib 007a,3929,) writes:
>	But I still have the problem where /bin/login won't let anyboy loggin. 
>Sometimes it will let you remsh over, but that's rare. And it turns out that
>if you delete /etc/utmp and then try it, you can get in. Also, the check sum 
>is way of (my sum of /bin/login is :50122 200 /bin/login) what the normal sum
>should be, something like 60000 or so. The person I got the tape from said she
>had a similar problem after she installed, but it `went away'.  Does any one 
>have a clue ? 

You most likely have a unsupported command that writes to /etc/utmp.  At
7.0 the structure and/or size of /etc/utmp changed.  When /etc/utmp is
corrupted in this manner, you will see messages like ''No utmp entry.
You must exec "login" from the lowest level "sh"''.  One common offender
I have heard about is telnetd.  Whatever it is, it needs to be
recompiled.

Hope this helps.

Bruce Rodean
rodean@hpfcla.FC.HP.COM

This does not represent any official position of Hewlett-Packard Co.  I
alone am responsible for its content.  No guarantees given or implied.

raf@hpfcdc.HP.COM (Rick Ferreri) (07/10/90)

> 	Hello again,
> 
> 	I recently upgraded to 7.0 and I'm still having some problems.  First 
> off, I should tell you it's a 7.0 tape that I got from a friend of mine who got
> her tape back in Feburary. (Hp still hasn't shipped ours, and I couldn't wait 
> until it came in the mail.  Too much other stuff that hinged on 7.0 was waiting
> for it.)  My friend said that the 3 patches had allready been integrated into 
> the tape. And in fact the HP S/W person was able to confirm that.  
> 
> 	But I still have the problem where /bin/login won't let anyboy loggin. 
> Sometimes it will let you remsh over, but that's rare.  And it turns out that 
> if you delete /etc/utmp and then try it, you can get in. Also, the check sum 
> is way of (my sum of /bin/login is :50122 200 /bin/login) what the normal sum
> should be, something like 60000 or so. The person I got the tape from said she
> had a similar problem after she installed, but it `went away'.  Does any one 
> have a clue ? 
> 
> 	Thanks alot,
> 	greg
> 
> 	(i'm running 7.0 on a hp9000s300 machine)
> 				Greg Sylvain
> 				Academic Computing Services
> 				Systems Programmer
> 			
> 	UUCP:           	...!{uunet}!umbc5!greg
> 	Internet (Arpa) :	greg@umbc5.umbc.edu
>  	BITNET :		GREGS@UMBC
> ----------
> 

The /etc/utmp file structure changed in 7.0.  The 7.0 ReleaseNotes file
should have had the following statement, however, it was not shipped with
the on-line version.

   <utmp.h>:
   ---------
   Due to  changes  made  for  POSIX  conformance,  a new type  has been
   introduced  for 7.0.  This new type is  pid_t.  Prior  to 7.0,  pid's
   were of type short, but for 7.0 the kernel will be treating  pid's as
   type long.  Although pid's will now be treated as longs, the value of
   MAXPID  will not be changed in user space in the near  future.  Since
   the type pid_t is now being  introduced, it was felt that this is the
   best  time  (7.0) to  introduce  this  change  to the utmp  structure
   defined in <utmp.h>.  Changing the ut_pid field of struct utmp from a
   short  to a long  (pid_t)  will  break  object  compatibility  of any
   program  which  attempts  to read  from or  write  to the  /etc/utmp,
   /etc/wtmp or /etc/btmp files.

   In  addition to  changing  ut_pid to a long from a short, it was also
   decided to add a couple of new fields to the utmp structure  since we
   are already breaking object  compatibility.  The ut_host[] field is a
   16 byte array of type char (as in BSD) used to  maintain  the name of
   the  remote  host from  which a user is logged  into the local  host.
   Also, the  ut_addr  field has been  added.  This field  contains  the
   internet  address.  Note that the 7.0  commands do not support  these
   fields.  Support  for  ut_host  and  ut_addr is planned  for a future
   release of HP-UX.

   **If  there  is an  application  left on a 7.0  system  which  writes
   entries into the /etc/utmp file in the *old* format, you will see the
   following  message  when  trying to log into the system  (after  that
   application has been executed):

      'No utmp entry. You must exec "login" from lowest level "sh"'

   This message means that the /etc/utmp file has been corrupted.  It is
   quite  likely that the  /etc/wtmp  file has been  corrupted  too.  To
   remedy this  situation, you must "cat /dev/null > /etc/wtmp" as root.
   This will clear out the  /etc/wtmp  file.  Then  reboot  your  system
   (this will clear out the /etc/utmp  file).  After this has been done,
   please remove the offending executable.  You may recompile the source
   code  on  the  7.0   system  and  then   re-install   it.  Note  that
   applications  which  manipulate  tty's and pty's  often  create  utmp
   entries.

Please note that the corruption of the utmp file may occur because of a
user application which writes data into the /etc/utmp file in the old
format.  If this is the case, then the simpelest solution is to recompile
that source code on your 7.0 system.  Another possibility is that you
haven't updated the entire system.  Is it possible that you still have 6.5
versions of /etc/rlogind, /etc/telnetd, /usr/bin/X11/hpterm or
/usr/bin/X11/xterm?  An older version of these or a similar program will
cause this problem too.

I hope this information helps.

Thanks,

Rick Ferreri
Hewlett-Packard Co.
Ft. Collins, Co

UUCP: hplabs!hpfcla!raf
ARPA: raf%hpfcla@hplabs.hp.com
Phone: (303) 229-6346