UNIX owner 42286?

An AIX 6.1 server with a NFS share mounted worked for years but then changed owner on all of the files and folders on the mount from sbladmin to a 5 digit code: 42286. It didn't change the group but we're having to do a large cleanup across 5 servers and 4 mounts. Does anyone know why EMC (or UNIX) did this?

Al Zuun

Posted 2016-10-21T18:13:28.713

Reputation: 1

Answers

The number is the UID of the files owner. If there isn't an user with the same UID on the system connected to the share, then it won't be resolved into an login (username).

DrNoone

Posted 2016-10-21T18:13:28.713

Reputation: 1 267

Thanks, Dr. N. I've been using "UID" in my new correspondence with the UNIX team. :) The login never changed so we've got to figure out why it suddently – Al Zuun – 2016-10-21T20:44:08.887

reported it via UID instead of the login name.

< – Al Zuun – 2016-10-21T20:45:25.493

Knowing WHY is of course, difficult. As it would have to change the UID on all inodes of all files and directories on the NFS server - under the assumption that the clients have not changed - I would be worried that my server had been hacked

someone with root access ran a specific chown command (probably together with find)

More likely is that something changed on the clients - and the client definition of user sbladmin, e.g., if you changed to LDAP and sbladmin has a different uid in that registry than was/is in /etc/passwd.

In short, the most likely WHY, imho, is a change in how users are identified by the system and in the new "system" uid 42286 is not defined. You can check for one or the other by examining an old backup and verifying what the UID was on old backups compared to what the numerical value is now.

Michael Felt

Posted 2016-10-21T18:13:28.713

Reputation: 111