From: Conor Daly (conor.daly at domain oceanfree.net)
Date: Sat 18 Aug 2001 - 12:30:12 IST
On Fri, Aug 17, 2001 at 10:21:18AM +0100 or so it is rumoured hereabouts,
Fred Cummins thought:
> On a RH 7.0 box, suddenly I can't login at the console. If I try as a
> user, I get a "Login incorrect" message, and /var/log/messages records
>
> Aug 17 10:13:20 damba PAM_unix[1397]: authentication failure;
> LOGIN(uid=0) -> fred for system-auth service
> Aug 17 10:13:20 damba login[1397]: FAILED LOGIN 1 FROM (null) FOR fred,
> Authentication failure
>
> Similarly with root, but then I get the additional log message:
>
> Aug 17 10:14:19 damba PAM-securetty[1397]: Error opening /etc/securetty
> Aug 17 10:14:24 damba PAM-securetty[1454]: Error opening /etc/securetty
>
> There is nothing obvously wrong with /etc/securetty (permissions
> -rw-------, contents identical to a working RH 7.1 box).
>
> I can rlogin ok (and I thought I had that disabled.....), though telnet
> experiences the same authentication problems (and I'm sure that was
> disabled). (ssh connection is refused. I thought that used to
> work....)
>
> The box's recent history involves a change of hostname, IP address,
> monitor/kbd/mouse and the excision of a zip drive, otherwise nothing
> spectacular.
Wild guess...
Has the box been r00ted? Stuff enabled that used to be disabled and stuff
diasbled that used to be enabled and things. Don't know offhand where the
"how to figure out if you've been rooted and what to do" website is but
it's out there somewhere...
Conor
-- Conor Daly <conor.daly at domain oceanfree.net> Domestic Sysadmin :-) --------------------- Faenor.cod.ie 12:22am up 64 days, 40 min, 0 users, load average: 0.08, 0.02, 0.01 Hobbiton.cod.ie 12:24am up 64 days, 1:08, 1 user, load average: 0.00, 0.00, 0.00
This archive was generated by hypermail 2.1.6 : Thu 06 Feb 2003 - 13:11:43 GMT