user "sysadm" a/c disable frequently

[Mohammed Imran]

Gentlemen,

One of user "sysadm" is getting locked by it's own & I had checked the log and found the following deiscrepency.
Mar 13 08:02:35 sa1 remshd[28483]: PAM Status - 28, PAM Error Message - Account is disabled - see Account Administrator
Mar 13 08:02:36 sa1 remshd[28524]: PAM Status - 28, PAM Error Message - Account is disabled - see Account Administrator
Mar 13 08:20:42 sa1 rexecd[28770]: PAM Status - 10, PAM Error Message - Get new authentication token
Mar 13 08:20:03 sa1 : su : - tty?? sysadm-sysadm
Mar 13 08:21:03 sa1 above message repeats 6 times
Please advise the remedy.
Thank you,
Mohammed

[Arunvijai_4]

Hi,

You can enable it by,

# /usr/lbin/modprpw -e sysadm


-Arun

[Peter Godron]

Mohammed,
another system is using remote shell to attempt to execute a command.

Try to get more info with
inetd -l
which should log to /var/adms/syslog/syslog.log

[Muthukumar_5]

Is there any new pam module in /etc/pam.conf file for login?

--
Muthu

[Sivakumar TS]

Hi Mohammed,

#modprpw -k

is the command to UNLOCK the user account.

Regards,

Siva.

[Sivakumar TS]

Hi Mohammed,

In modprpw, database u_maxtries,is the parameter that sets the Maximum unsuccessful Login tries allowed.

0 = infinite.

Incase if you dont want the account to get locked, you may set this.

Regards,

Siva.

[Mohammed Imran]

Gentlemen,
Please the check the attached log from /var/adm/syslog/sylog.log for your investigation.
Thank you.
imran

[Muthukumar_5]

Problem is when you are trying to use remsh or rexec commands. Can you try and reproduce the same errors?

By which account you have tried to do remsh or rexec? what is your operating system? uname -a will give that.

I hope /etc/pam.conf file is having a module which is making the problem in login with r* commands.

--
Muthu

[Mohammed Imran]

Dear Muthu,

My os is 11.00 and how do i konw which account is doing the remsh.

pls check the log which i had sent and advise.
thank you,
imran

[Peter Godron]

Mohammed,
please see my earlier response.
inetd -l
will switch on logging of all connection attempts.

See man inetd

[Mohammed Imran]

Dear Peter,
I did the inetd -l but still the same only user sysadm is getting locked.
thanks,
imran