RE: getgroup invalid argument in /var/adm/messages

I believe you're right. I grep'd with the word count (provided below), and came up with 0. I decided to manually go through the file (I'm in the midst of doing it right now) and there are no instances of ssh/d.

The groups file is a means of administering user permissions to groups of files, not processes having permissions for users. However, I wasn't going to argue :-) With the exception of "mail" I don't believe any processes are normally found in /etc/group. Given the sporadic nature of the alarms, it made me believe that it was related to both users logging in and CRONjobs/scripts. With the explanation you provide, it falls in line with what I was thinking. I know in the past we've had problems with some processes due to too many groups in the /etc/group file. I believe NFS or something has a hard time with large numbers of groups in Solaris8.

As I mentioned, I'm editing by hand. So possibly tomorrow I will post a message here. I'll append the subject with <SOLVED> or some telltale.

Thanks again, this is why I love OpenSource !!! You guys are a tremendous help, and hope I can contribute something in return.

John

-----Original Message-----
From: Ramin Dousti [mailto:ramin@cannon.eng.us.uu.net] Sent: Thursday, July 24, 2003 3:06 PM
To: djtech@djtech.org
Cc: Schubert, John [NTWK SVCS]; Ramin Dousti; secureshell@securityfocus.com
Subject: Re: getgroup invalid argument in /var/adm/messages

I might be wrong but I don't think its a matter of "sshd" belonging to what groups. It's the user who is logging into the machine, for whom a forked sshd is running, belonging to what groups. (I hope my statement is grammatically correct ;-)

Ramin

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

On Thu, Jul 24, 2003 at 03:17:20PM -0400, djtech@djtech.org wrote:

> Sounds like SSH is doing its job then. To see how many groups sshd is in use
Received on Thu Jul 24 17:15:22 2003