Unable to login through telnet and ssh to the Linux server

[Adithyan]

Hi,

OS RH AS 3.0 Up 3.0
on 6th of this month immediately no one was able to login to the server. Login prompt was available for both telnet and ssh.

For temporary purpose we have reset the password for a few users, then they were able to login.

Any idea what could went bad in the server? In the /var/log/messages i could only see the login failed message only.

Please help to find the root cause.

Thanks
Adithyan

[Rob Leadbeater]

Hi,

Is there anything in /var/log/security ??

Cheers,

Rob

[Adithyan]

Jun 6 08:18:12 cmfciohprap06 xinetd[1252]: START: telnet pid=24842 from=3.209.2
20.80
Jun 6 08:18:23 cmfciohprap06 sshd[24840]: Failed password for ng99tgt from 3.20
5.149.97 port 1473 ssh2
Jun 6 08:18:40 cmfciohprap06 sshd[24855]: Illegal user ng99ept from 3.205.149.9
7
Jun 6 08:18:48 cmfciohprap06 sshd[24855]: Failed password for illegal user ng99
ept from 3.205.149.97 port 1474 ssh2
Jun 6 08:19:51 cmfciohprap06 sshd[24886]: Failed password for pat340 from 3.205
.149.97 port 1475 ssh2

These outputs are there in the /var/log/secure. Nothing relevant.

[Ivan Ferreira]

I would like to see one line of the shadow file for one user that does not works. Are you using shadow for authentication? Or a directory service?

Try with usermod -U username, maybe for some reason (or someone) the user was locked.

[skt_skt]

The chances are high the login acconts(passords) were expired/locked.. I had a similar problem and found those accounts were created on the same day earlier and the expiry date was same.Check the current expiry date for couple of users.