On Sat, Jun 11, 2011 at 08:46, terry white <twhite@xxxxxxxxxx> wrote: > all of a sudden, i am only able to login as root. this is not something Computers are deterministic machines. Nothing happens 'all of the sudden'. The "Have you recently dicked with" checklist: 1) pam 2) ulimits 3) permissions 4) selinux 5) /etc/passwd 6) .bashrc .bash_profile /etc/profile* 7) df -h (Is the disk full) > as a given, login as a valid user, with correct password, terminated > immediately, with a new login prompt. invalid login attempts iterate until > a new session initiated. Sounds like a shell related problem if it seems to instantaneously log in and then kick you back out. check the .bashrc .bash_profile /etc/profile* files for recent modifications. See if setting a user's shell to something else (csh, ksh, zsh, ash) makes a difference. > ftp, and smtp allowed, telnet fails. Telnet should fail. It does sound like a malicious attacker has compromised your system though, because that's the only way authenticated FTP would be working. And I hope to got you're using TLS on smtp. > i'm not seeing anything mentioned in the logs with regard to failed > normal user login. i'm at a loss as to where i might start looking. Which logs have you checked so far? -- To unsubscribe from this list: send the line "unsubscribe linux-admin" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
