topic Re: Unable to login through telnet and ssh to the Linux server in Operating System - Linux

Unable to login through telnet and ssh to the Linux server

Adithyan — Fri, 08 Jun 2007 09:09:19 GMT

Hi,

OS RH AS 3.0 Up 3.0
on 6th of this month immediately no one was able to login to the server. Login prompt was available for both telnet and ssh.

For temporary purpose we have reset the password for a few users, then they were able to login.

Any idea what could went bad in the server? In the /var/log/messages i could only see the login failed message only.

Please help to find the root cause.

Thanks
Adithyan

Re: Unable to login through telnet and ssh to the Linux server

Rob Leadbeater — Fri, 08 Jun 2007 09:20:41 GMT

Hi,

Is there anything in /var/log/security ??

Cheers,

Rob

Re: Unable to login through telnet and ssh to the Linux server

Adithyan — Fri, 08 Jun 2007 09:52:23 GMT

Jun 6 08:18:12 cmfciohprap06 xinetd[1252]: START: telnet pid=24842 from=3.209.2
20.80
Jun 6 08:18:23 cmfciohprap06 sshd[24840]: Failed password for ng99tgt from 3.20
5.149.97 port 1473 ssh2
Jun 6 08:18:40 cmfciohprap06 sshd[24855]: Illegal user ng99ept from 3.205.149.9
7
Jun 6 08:18:48 cmfciohprap06 sshd[24855]: Failed password for illegal user ng99
ept from 3.205.149.97 port 1474 ssh2
Jun 6 08:19:51 cmfciohprap06 sshd[24886]: Failed password for pat340 from 3.205
.149.97 port 1475 ssh2

These outputs are there in the /var/log/secure. Nothing relevant.

Re: Unable to login through telnet and ssh to the Linux server

Ivan Ferreira — Fri, 08 Jun 2007 10:53:13 GMT

I would like to see one line of the shadow file for one user that does not works. Are you using shadow for authentication? Or a directory service?

Try with usermod -U username, maybe for some reason (or someone) the user was locked.

Re: Unable to login through telnet and ssh to the Linux server

skt_skt — Fri, 08 Jun 2007 21:59:10 GMT

The chances are high the login acconts(passords) were expired/locked.. I had a similar problem and found those accounts were created on the same day earlier and the expiry date was same.Check the current expiry date for couple of users.