AIX 5.2

Whenever somebody logs in to our AIX system, it creates an apparently
randomly named file if 6 characters with the following format:

LOGIN <UID> <TERMINAL> <REMOTE_HOST> <DATE> <TIME>

i.e.:
File named /tmp/NpQhya contains the following text:
LOGIN cab pts/0 192.163.1.1 06/25/04 12:17:15

It does it for at least telnet, ssh, and ftp. Any idea what is creating
these files and why?

Thanks,
CAB

CAB <CAB@newsguy.com> wrote in message news:<pan.2004.09.21.18.08.07.189006@newsguy.com>. ..
> AIX 5.2
>
> Whenever somebody logs in to our AIX system, it creates an apparently
> randomly named file if 6 characters with the following format:
>
> LOGIN <UID> <TERMINAL> <REMOTE_HOST> <DATE> <TIME>
>
> i.e.:
> File named /tmp/NpQhya contains the following text:
> LOGIN cab pts/0 192.163.1.1 06/25/04 12:17:15
>
> It does it for at least telnet, ssh, and ftp. Any idea what is creating
> these files and why?
>
> Thanks,
> CAB


/etc/profile perhaps ?

BV

On Wed, 22 Sep 2004 14:29:31 -0700, Bill wrote:

> CAB <CAB@newsguy.com> wrote in message news:<pan.2004.09.21.18.08.07.189006@newsguy.com>. ..
>> AIX 5.2
>>
>> Whenever somebody logs in to our AIX system, it creates an apparently
>> randomly named file if 6 characters with the following format:
>>
>> LOGIN <UID> <TERMINAL> <REMOTE_HOST> <DATE> <TIME>
>>
>> i.e.:
>> File named /tmp/NpQhya contains the following text:
>> LOGIN cab pts/0 192.163.1.1 06/25/04 12:17:15
>>
>> It does it for at least telnet, ssh, and ftp. Any idea what is creating
>> these files and why?
>>
>> Thanks,
>> CAB
>
>
> /etc/profile perhaps ?
>
> BV

Not that I can see, it looks vanilla to me. I've also tried a
grep "/tmp/\$" *
from /etc in the hopes I might stumble across something, no such luck
though.

CAB <CAB@newsguy.com> wrote in message news:<pan.2004.09.21.18.08.07.189006@newsguy.com>. ..
> Whenever somebody logs in to our AIX system, it creates an apparently
> randomly named file if 6 characters with the following format:
> LOGIN <UID> <TERMINAL> <REMOTE_HOST> <DATE> <TIME>
> It does it for at least telnet, ssh, and ftp. Any idea what is creating
> these files and why?

You can try checking the /etc/security/user file and examine the
"auth1" setting to see if it is calling anything special. The
/etc/security/login.cfg might also show you some clues to this.

These are also good candidates.

/etc/profile
/home/$USER/.profile

Do you know if auditing of users is turned on? Maybe that is actually
creating the files.

Regards,

Steve

On Mon, 27 Sep 2004 08:57:46 -0700, Steve N. wrote:

> CAB <CAB@newsguy.com> wrote in message news:<pan.2004.09.21.18.08.07.189006@newsguy.com>. ..
>> Whenever somebody logs in to our AIX system, it creates an apparently
>> randomly named file if 6 characters with the following format:
>> LOGIN <UID> <TERMINAL> <REMOTE_HOST> <DATE> <TIME>
>> It does it for at least telnet, ssh, and ftp. Any idea what is creating
>> these files and why?
>
> You can try checking the /etc/security/user file and examine the
> "auth1" setting to see if it is calling anything special. The
> /etc/security/login.cfg might also show you some clues to this.
>
> These are also good candidates.
>
> /etc/profile
> /home/$USER/.profile
>
> Do you know if auditing of users is turned on? Maybe that is actually
> creating the files.
>
> Regards,
>
> Steve

auth1 just points to SYSTEM, so that shouldn't be it, and login.cfg looks
normal. /etc/profile looks fine, and ~/.profile only expands on the $PATH
setting. sar is off.

I'm completely baffled on this one.

Thanks for the suggestions,
CAB