Syslog message (PAM error)

[Starrynight_1]

Hello everyone

Every 5 minutes I am receiveing this message on syslog.log file:

Nov 27 14:55:26 pthp28 remshd[13710]: PAM Status - 28, PAM Error Message - Accou
nt is disabled - see Account Administrator

I can see that this problem is related with an action done by remote shell. I just can??t see what is causing it.
As the message has an interval of exactly 5 minutes I??ve checked the crontab. I found this script that has a line with the word "remshd". That line is:

echo "file = rbootd,telnet*,ftp*,*rlogin*,remsh*,rcp,nktl*,nvsisr,ttisr"

But, since it is an echo I can not see any relation with the message.

Anyone can help?

Thank??s in advance

[Duncan Edmonstone]

This could be coming from another node - if you turn on inetd logging you should see which one:

inetd -l

will enable logging into syslog

HTH

Duncan

[Uday_S_Ankolekar]

Hi,

This is realted to authenticate a current user.

Do a man on pam for more details.

Goodluck,
-USA..

[Steven Gillard_2]

A remote system is attempting to run a command via remsh using an account that has been disabled (ie has a '*' in the password field of /etc/passwd).

Turn on inetd logging just before the next connection and you'll see where its coming from. If you need more information such as what username and command is being used, use nettl to obtain a network trace of the remsh traffic.

Regards,
Steve

[Starrynight_1]

Unfortunatelly I ran the command inetd -l and nothing happened. The message is still the same!
I can??t also see how the pam command can help me to identify the user and the host that is trying to make the conection...
Can you guys be more specific, please?

SN

[Duncan Edmonstone]

So you don't see anything like this in your syslog...
Nov 27 17:16:03 dilbert inetd[826]: Connection logging enabled
Nov 27 17:16:08 dilbert inetd[20221]: shell/tcp: Connection from dogbert (10.0.0.1) at Tue Nov 27 17:16:08 2001

Just before your PAM error message?