password expires everyday

[Steve Casino]

Hi Everyone,

I have a problem with a user account whose password expires everyday. I checked the syslog and i saw that the particular account is trying log in every hour

Dec 31 12:00:03 xxxx ftpd[6372]: User tm0807: Login incorrect
Dec 31 12:00:03 xxxx ftpd[6372]: User tm0807: Login incorrect
Dec 31 13:00:00 xxxx ftpd[2019]: User tm0807: Login incorrect
Dec 31 13:00:00 xxxx ftpd[2019]: User tm0807: Login incorrect

We are trying to identify from which host it tries to log in from. Can anyone tell me why the source IP address does not show up? Other ftp login attempts show the IP address

Dec 31 13:21:34 xxxx ftpd[11599]: FTP LOGIN FROM 143.5.116.101 [143.5.116.101], gbaps

Thanks!

[Stephen Keane · Accepted solution]

You could put tm0807 in /etc/ftpd/ftpusers
to stop remote access to that user account in ftp. That might throw up a better error in syslog?

[Sunil Sharma_1]

password may not be expiring, it may be gettign locked because of bad login attempt. Some script from cron may be tring to login and because of incorrect password for some pre defined number user may be gettign locked.

You have to find out which host is tring to do this ?

regarding IP Address is syslog, it's not showing because login is not happening.
Sunil

[Peter Godron]

The quickest way to trace this is to first check if the connection is internal i.e. check the /var/spool/cron/crontabs for hourly jobs.
If that does not show anything use snoop (or equiv) to monitor network traffic to the ftp port. That should then give you an ip-address. At least you know when to expect the attempted connection!

[Michael_356]

Hi there,

as far as i know there's no way to get an ip-adress from telnetd.
If you want to find out from where the bad logins come, try intalling ethereal and trace for port 23

regards

Michael

[Steve Casino]

Thanks everyone...i rechecked the syslog and saw that i am getting login failures now...with the IP address!!

[Peter Godron]

Steve,
If the problem is resolved can you please close the thread.
Thanks