topic Re: password expires everyday in Operating System - HP-UX

password expires everyday

Steve Casino — Wed, 12 Jan 2005 07:04:36 GMT

Hi Everyone,

I have a problem with a user account whose password expires everyday. I checked the syslog and i saw that the particular account is trying log in every hour

Dec 31 12:00:03 xxxx ftpd[6372]: User tm0807: Login incorrect
Dec 31 12:00:03 xxxx ftpd[6372]: User tm0807: Login incorrect
Dec 31 13:00:00 xxxx ftpd[2019]: User tm0807: Login incorrect
Dec 31 13:00:00 xxxx ftpd[2019]: User tm0807: Login incorrect

We are trying to identify from which host it tries to log in from. Can anyone tell me why the source IP address does not show up? Other ftp login attempts show the IP address

Dec 31 13:21:34 xxxx ftpd[11599]: FTP LOGIN FROM 143.5.116.101 [143.5.116.101], gbaps

Thanks!

Re: password expires everyday

Stephen Keane — Wed, 12 Jan 2005 07:15:52 GMT

You could put tm0807 in /etc/ftpd/ftpusers
to stop remote access to that user account in ftp. That might throw up a better error in syslog?

Re: password expires everyday

Sunil Sharma_1 — Wed, 12 Jan 2005 07:19:05 GMT

password may not be expiring, it may be gettign locked because of bad login attempt. Some script from cron may be tring to login and because of incorrect password for some pre defined number user may be gettign locked.

You have to find out which host is tring to do this ?

regarding IP Address is syslog, it's not showing because login is not happening.
Sunil

Re: password expires everyday

Peter Godron — Wed, 12 Jan 2005 07:43:45 GMT

The quickest way to trace this is to first check if the connection is internal i.e. check the /var/spool/cron/crontabs for hourly jobs.
If that does not show anything use snoop (or equiv) to monitor network traffic to the ftp port. That should then give you an ip-address. At least you know when to expect the attempted connection!

Re: password expires everyday

Michael_356 — Wed, 12 Jan 2005 07:44:33 GMT

Hi there,

as far as i know there's no way to get an ip-adress from telnetd.
If you want to find out from where the bad logins come, try intalling ethereal and trace for port 23

regards

Michael

Re: password expires everyday

Steve Casino — Wed, 12 Jan 2005 07:50:57 GMT

Thanks everyone...i rechecked the syslog and saw that i am getting login failures now...with the IP address!!

Re: password expires everyday

Peter Godron — Thu, 13 Jan 2005 04:08:11 GMT

Steve,
If the problem is resolved can you please close the thread.
Thanks