PAM Error Message - Authentication failed

[AHMED ABDOU]

Hi admin

We are getting the following error message in Syslog.log file.
Can you please advise what is the problem and how to stop this message?

Oct 1 07:26:27 ajwahp rexecd[28828]: PAM Status - 9, PAM Error Message - Authentication failed
Oct 1 07:56:14 ajwahp rexecd[29995]: PAM Status - 9, PAM Error Message - Authentication failed
Oct 1 08:47:10 ajwahp rexecd[1876]: PAM Status - 9, PAM Error Message - Authentication failed
Oct 1 08:47:28 ajwahp : su : + td root-oracle
Oct 1 08:53:07 ajwahp tftpd[1749]: Timeout (no requests in 10 minutes)
Oct 1 08:55:29 ajwahp rexecd[2195]: PAM Status - 9, PAM Error Message - Authentication failed
Oct 1 08:56:21 ajwahp rexecd[2344]: PAM Status - 9, PAM Error Message - Authentication failed
Best regards,

[Animesh Chakraborty]

Hi,
It is basically a login failure, specifically an rexec failed to run due to bad password or permission problem. Rexec is used to run a program on a remote host.
Do man pam for more info.



The list of possible messages and what they mean.



/* Generic PAM errors */
#define PAM_SUCCESS 0 /* Normal function return */
#define PAM_OPEN_ERR 1 /* Shared object load failure */
#define PAM_SYMBOL_ERR 2 /* Symbol not found */
#define PAM_SERVICE_ERR 3 /* Error in underlying service module */
#define PAM_SYSTEM_ERR 4 /* System error */
#define PAM_BUF_ERR 5 /* Memory buffer error */
#define PAM_CONV_ERR 6 /* Conversation failure */
#define PAM_PERM_DENIED 7 /* Permission denied */

/* Errors returned by pam_authenticate, pam_acct_mgmt(), and pam_setcred()
*/
#define PAM_MAXTRIES 8 /* Maximum number of tries exceeded */
#define PAM_AUTH_ERR 9 /* Authentication failure */
#define PAM_AUTHTOKEN_REQD 10 /* Get new auth token from the user */
#define PAM_CRED_INSUFFICIENT 11 /* can not access auth data b/c */
/* of insufficient credentials */
#define PAM_AUTHINFO_UNAVAIL 12 /* Can not retrieve auth information */
#define PAM_USER_UNKNOWN 13 /* No account present for user */

/* Errors returned by pam_setcred() */
#define PAM_CRED_UNAVAIL 14 /* can not retrieve user credentials */
#define PAM_CRED_EXPIRED 15 /* user credentials expired */
#define PAM_CRED_ERR 16 /* failure setting user credentials */

/* Errors returned by pam_acct_mgmt() */
#define PAM_ACCT_EXPIRED 17 /* user account has expired */
#define PAM_AUTHTOK_EXPIRED 18 /* Password expired and no longer */
/* usable */
/* Errors returned by pam_open/close_session() */
#define PAM_SESSION_ERR 19 /* can not make/remove entry for */
/* specified session */

/* Errors returned by pam_chauthtok() */
#define PAM_AUTHTOK_ERR 20 /* Authentication token */
/* manipulation error */
#define PAM_AUTHTOK_RECOVERY_ERR 21 /* Old authentication token */
/* cannot be recovered */
#define PAM_AUTHTOK_LOCK_BUSY 22 /* Authentication token */
/* lock busy */
#define PAM_AUTHTOK_DISABLE_AGING 23 /* Authentication token aging */
/* is disabled */

/* Errors returned by pam_get_data */
#define PAM_NO_MODULE_DATA 24 /* module data not found */

/* Errors returned by modules */
#define PAM_IGNORE 25 /* ignore module */

#define PAM_ABORT 26 /* General PAM failure */
#define PAM_TRY_AGAIN 27 /* Unable to update password */
/* Try again another time */

#ifdef COMSEC
#define PAM_ACCT_DISABLED 28 /* Account is disabled */
#define PAM_TERM_DISABLED 29 /* Terminal is disabled */
#define PAM_NOT_AUTHORIZED 30 /* User is not authorized for
terminal access */
#define PAM_NOT_RTIME 31 /* Wrong time to login */
#define PAM_TERM_ERROR 32 /* Terminal database corruption or
no corresponding entry found */
#define PAM_PRPW_ERROR 33 /* Password database corruption
no corresponding entry found */

[Donald Kok]

Hi,
Maybe you can check with last and lastb who is having problem with logiing in.
Donald

[Edward Gruskin]

We are completely locked out of our system as any user id...including root. WE have replaced the passwd file with a generic one from the neconfig director...nothing works...HP seems stumped...any suggestions...this is not a Denial of Service attach.

Any assistance is appreciated.

We have checked all the PAM libraries for corruption and permissions...nothing is working.

[Steven E. Protter]

You need to go to the console of this machine and log on as root.

That will unlock the root account.

If that fails, boot the box and follow this procedure.

interupt when you see the 10 second prompt

bo

Y(es) interact with the IPL(ISL?)
hpux -is


Now you are in single user mode. You can now run the passwd command, but you'll have to give the full path of the command.

Either there is a configuration with your system(likely) or someone tried to hack your box, hence the locked users.

SEP