Path: utzoo!utgpu!news-server.csri.toronto.edu!bonnie.concordia.ca!uunet!spool.mu.edu!sdd.hp.com!hplabs!hpfcso!hpfcdc!ses
From: ses@hpfcdc.HP.COM (Steve Speer)
Newsgroups: comp.sys.hp
Subject: Re: Whats going on here then ?
Message-ID: <5570662@hpfcdc.HP.COM>
Date: 14 Jun 91 17:26:39 GMT
References: <1356@prlhp1.prl.philips.co.uk>
Organization: HP Fort Collins, Co.
Lines: 19

>> A couple of weeks ago I upgraded my HP9000-350 to HP-UX6.5
>> 
>> Today I noticed a couple of odd processes (see below) running owned by 
>> root, apparently going through the filesystem and doing something with 
>> acl's for uids 248 and 251.  These uids in fact belonged to two users 
>> that I deleted earlier today.

>You probably used SAM to remove those users, right?  It looks to me like
>
>Bruce Rodean

SAM didn't exist for S300 boxes in 6.5, I'd look further.  Not to be paranoid,
but have you considered that you may have a security problem?  I don't know,
but perhaps reconfig used a process similar to sam in 6.5 and Bruce's
suggestion could be right on.  6.5 is three years old now, why the delay and
why not a newer version (like 7.0)?

	-Steve
	 ses@hpfcls.hp.com