Can not log in except on console

[Stojcevski Dejan]

When I try to log in to the system via telnet I get the response:
'Direct login access for this user
is only allowed on the system console'.
Only root can log in via telnet. Every other user can log in to the system only trough console.OS: HP-UX 11i.
Any ideas?

[Senthil Kumar .A_1]

Hi Dejan,

Can you check your /var/adm/inetd.sec file. could be there is some restriction on telnet service usage.

Regards,
Senthil

[Kent Ostby]

check your set up in /etc/securetty although it should not have this type of behavior for non-root users.

check /etc/profile to see if anyone has set up a script.

Also compare telnetd on this box to telnetd on other boxes to see if someone has made a change there.

[Stojcevski Dejan]

/var/adm/inetd.sec is clean file with no entries except for service dtspc.
Also there is no file /etc/securetty in the file system.

[Arunvijai_4]

Hello,

Check your /etc/securetty file.

-Arun

[Senthil Kumar .A_1]

Hi Dejan,

Is there any entries made by telnetd daemon, in /var/adm/syslog/syslog.log file.

If so , it could give some clues.

Regards,
Senthil

[Stojcevski Dejan]

No entries what so ever in syslog !

[Peter Godron]

Hi,
when do you get this message? After supplying username/password ?

May be a silly suggestion, but have you checked your /etc/profile for some coding to this effect. We terminate all sessions for root this way. So root can only log on from console or via su.

[Muthukumar_5]

What is there /etc/profile file? May be some script to break normal user login.

Are you using any tcp wrappers or any configuration in /etc/pam_user.conf.

--
Muthu

[Muthukumar_5]

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=16369

--
Muthu

[Senthil Kumar .A_1]

Hi Dejan,

The pattern u have mentioned is very close to a behaviour found due to the existense of the file called /etc/login.access in BSD version of unix, not too sure, it would be in HPUX.

Still no harm in checking. Please check whether there is a file namely,

/etc/login.access

Regards,
Senthil

[Stojcevski Dejan]

/etc/pam_usr.conf is clean file with no entries.
As for the .profile file - it is clean - it is a default file which i do have on other machines and they are working fine.

[Stojcevski Dejan]

No file /etc/login.access on my system.

[Robert-Jan Goossens_1]

Hi,

Check if the option nologin is set in the /etc/default/security

NOLOGIN=1

and check if there is a message in the /etc/nologin.

Robert-Jan

[Senthil Kumar .A_1]

Hi Dejan,

2 more tests,

1) after login into a telnet session as root, are u able to switch to a normal user,

ex : su - user1

2) are you able to rlogin to the unix box as a normal user

Sorry for multiple replies.. just helping.. ;)

regards,
senthil

[Peter Godron]

Hi,
it the /etc/profile which gets executed before .profile in user directory.
Please check the /etc/profile file.

Try putting a debug statement like
echo "hello"
sleep 10
into the file. This would show what the daemons are accepting the connection.

[Muthukumar_5]

Check these:

1) /etc/nologin file + /etc/defaults/security for NOLOGIN
2) /etc/profile


--
Muthu

[Stojcevski Dejan]

Hello to all,
I have found the message displayed during the login in the /etc/preprofile file! Can anyone tell me what this file is for?
There is no /etc/default/security file nor /etc/nologin file in my filesystem.

[Peter Godron · Accepted solution]

Hi,
as I suspected!
The /etc/profile file is a system-wide file to set up basic setup on login. Normally stuff like PATH, TIMEZONE, TERMINAL are sourced here. Also the login banner.
After this , depending on the shell, the users own .profile,.login etc. files are called in the users login directory.

[Arunvijai_4]

Hello,

I have found the message displayed during the login in the /etc/preprofile file! Can anyone tell me what this file is for?
There is no /etc/default/security file nor /etc/nologin file in my filesystem.


/etc/preprofile or /etc/profile ??

Can you paste the malicious contents ?

-Arun

[Arunvijai_4]

Hello,

After the login program authentictes from /etc/password or /etc/shadow, it executes /etc/profile which is the default system wide setting and it goes on to individual user's profile.

-Arun

[Stojcevski Dejan]

First statement in /etc/profile is to source the /etc/prepeorfile file. Aftr that it goes in the user's home dir's and executes the .*** files. Now I have found the code on the /etc/preprofile file that is causing me the problems!
This is just for info. Consider this thread as closed.
Thanks to all.
Dejan.

[Stojcevski Dejan]

Closing.
Thanks again.