/etc/passwd file missing

[dk8415]

I am very new at UNIX and have been designated as a SYS ADM so I'm struggling! Something happened this morning with our /etc/passwd file. The only way I could log on was Root and then I had to reload our passwd file from a saved tape because the /etc/passwd file was missing.

I have 2 issues here. One, I'd like to find out how it became "missing". Two, what processes were running and who was on the system at the time. From my understanding, one would have to be SU to delete the file because it is owned by root. When I looked at our SUlog, it only shows today.

Any comments or suggestions would be greatly appreciated.

NEWBE.

 

[asb555]

you could try looking at the sulog file at /var/adm/ to see who SUed to root at the time in question. Also , there are some other logs in that directory that might help you. you could also check the /var/log/ directory.

Hope this helps!!!

 

[jad]

did the system crash? if the file was being read loads then it could be that on reboot that file was found to be corrupt and unlinked, other than that it sounds like someone with su/sudo access removed/tampered with it.