Authentication problem

[Stephen Liu]

Hi Wesley,


> On 09 Jun 2008, at 13:06, Stephen Liu wrote:
> > S: L01 NO Login failed: generic failure
> 
> These generic login failures typically produce a log message in your 
> 
> security logs.


Here are the logs


$ sudo ls -la /var/log/
total 48048
drwxr-xr-x  8 root  root      4096 2008-06-10 06:55 .
drwxr-xr-x 14 root  root      4096 2008-04-18 07:27 ..
drwxr-xr-x  2 root  root      4096 2008-04-18 07:28 apache2
-rw-r--r--  1 root  root      2856 2008-04-18 07:27 aptitude
-rw-r-----  1 root  adm     299868 2008-06-10 07:10 auth.log
-rw-r-----  1 root  adm      48035 2008-05-04 06:47 auth.log.0
-rw-rw-r--  1 root  utmp      1920 2008-05-05 03:50 btmp
drwxr-xr-x  2 root  root      4096 2008-05-07 06:25 cups
-rw-r-----  1 root  adm     710332 2008-06-10 06:55 daemon.log
-rw-r-----  1 root  adm      69032 2008-05-04 06:03 daemon.log.0
-rw-r-----  1 root  adm     404471 2008-06-10 06:56 debug
-rw-r-----  1 root  adm      76075 2008-05-04 05:59 debug.0
-rw-r--r--  1 root  root     19690 2008-06-10 06:54 dmesg
-rw-r-----  1 root  adm     224936 2008-06-07 12:23 dpkg.log
-rw-r--r--  1 root  root     15896 2008-06-09 23:16 evms-engine.1.log
-rw-r--r--  1 root  root     15896 2008-06-09 21:26 evms-engine.2.log
-rw-r--r--  1 root  root     15896 2008-06-09 16:11 evms-engine.3.log
-rw-r--r--  1 root  root     15896 2008-06-09 14:10 evms-engine.4.log
-rw-r--r--  1 root  root     15896 2008-06-09 08:10 evms-engine.5.log
-rw-r--r--  1 root  root     15896 2008-06-08 22:08 evms-engine.6.log
-rw-r--r--  1 root  root     15896 2008-06-08 17:57 evms-engine.7.log
-rw-r--r--  1 root  root     15896 2008-06-07 23:39 evms-engine.8.log
-rw-r--r--  1 root  root     15896 2008-06-07 22:13 evms-engine.9.log
-rw-r--r--  1 root  root     15896 2008-06-10 06:54 evms-engine.log
-rw-r--r--  1 root  root     32160 2008-06-10 01:22 faillog
-rw-r--r--  1 root  root       681 2008-04-24 01:24 fontconfig.log
drwxr-xr-x  3 root  root      4096 2008-04-18 07:29 installer
-rw-r-----  1 root  adm    2000232 2008-06-10 06:55 kern.log
-rw-r-----  1 root  adm     455682 2008-05-04 05:59 kern.log.0
-rw-rw-r--  1 root  utmp    293460 2008-06-10 07:10 lastlog
-rw-r--r--  1 root  root         0 2008-04-18 07:30 lpr.log
-rw-r--r--  1 root  root   3437682 2008-06-10 00:59 mail.err
-rw-r--r--  1 root  root   6462532 2008-06-10 06:55 mail.info
-rw-r--r--  1 root  root  11019216 2008-06-10 06:55 mail.log
-rw-r--r--  1 root  root   6322797 2008-06-10 00:59 mail.warn
-rw-r-----  1 root  adm    1698219 2008-06-10 06:55 messages
-rw-r-----  1 root  adm     386020 2008-05-04 06:47 messages.0
drwxr-s---  2 mysql adm       4096 2008-06-10 06:55 mysql
-rw-r-----  1 mysql adm          0 2008-05-06 01:32 mysql.err
-rw-r-----  1 mysql adm          0 2008-05-07 06:25 mysql.log
-rw-r-----  1 mysql adm         20 2008-05-06 01:32 mysql.log.1.gz
drwxr-sr-x  2 news  news      4096 2008-04-18 07:30 news
drwxr-x---  2 proxy proxy     4096 2008-05-07 06:25 squid
-rw-r-----  1 root  adm   13395209 2008-06-10 07:09 syslog
-rw-r-----  1 root  adm     424533 2008-05-07 06:25 syslog.0
-rw-r-----  1 root  adm     115845 2008-05-04 06:25 syslog.1.gz
-rw-r--r--  1 root  root    268321 2008-06-10 06:54 udev
-rw-r-----  1 root  adm       5228 2008-06-10 01:22 user.log
-rw-r-----  1 root  adm       5058 2008-05-04 06:03 user.log.0
-rw-r--r--  1 root  root         0 2008-04-18 07:30 uucp.log
-rw-rw-r--  1 root  utmp    939264 2008-06-10 07:10 wtmp
* end *


Which is the security log?  Thanks


$ tail /var/log/auth.log
Jun 10 01:22:12 lampserver login[4403]: (pam_unix) session opened for
user root by (ui
d=0)
Jun 10 01:22:12 lampserver login[31808]: ROOT LOGIN  on `tty1'
Jun 10 01:22:22 lampserver saslauthd[4198]: server_exit     : master
exited: 4198
Jun 10 01:22:22 lampserver sshd[4218]: Received signal 15; terminating.
Jun 10 06:55:13 lampserver saslauthd[4197]: detach_tty      : master
pid is: 4197
Jun 10 06:55:13 lampserver saslauthd[4197]: ipc_init        : listening
on socket: /va
r/spool/postfix/var/run/saslauthd/mux
Jun 10 06:55:13 lampserver sshd[4224]: Server listening on :: port
2222.
Jun 10 06:56:26 lampserver sshd[4432]: Accepted password for satimis
from 192.168.0.10
 port 46317 ssh2
Jun 10 06:56:26 lampserver sshd[4434]: (pam_unix) session opened for
user satimis by (
uid=0)
Jun 10 07:07:33 lampserver sudo:  satimis : TTY=pts/0 ;
PWD=/home/satimis ; USER=root 
; COMMAND=/bin/ls /var/log/
* end *


B.R.
Stephen

Send instant messages to your online friends http://uk.messenger.yahoo.com