Re: only root allowed login ...

On Sat, Jun 11, 2011 at 08:46, terry white <[email protected]> wrote:
>    all of a sudden, i am only able to login as root.  this is not something

Computers are deterministic machines.  Nothing happens 'all of the sudden'.

The "Have you recently dicked with" checklist:
1) pam
2) ulimits
3) permissions
4) selinux
5) /etc/passwd
6) .bashrc .bash_profile /etc/profile*
7) df -h (Is the disk full)

>    as a given, login as a valid user, with correct password, terminated
> immediately, with a new login prompt.  invalid login attempts iterate until
> a new session initiated.

Sounds like a shell related problem if it seems to instantaneously log
in and then kick you back out.  check the .bashrc .bash_profile
/etc/profile* files for recent modifications.  See if setting a user's
shell to something else (csh, ksh, zsh, ash) makes a difference.

>    ftp, and smtp allowed, telnet fails.

Telnet should fail.  It does sound like a malicious attacker has
compromised your system though, because that's the only way
authenticated FTP would be working.  And I hope to got you're using
TLS on smtp.

>    i'm not seeing anything mentioned in the logs with regard to failed
> normal user login.   i'm at a loss as to where i might start looking.

Which logs have you checked so far?
--
To unsubscribe from this list: send the line "unsubscribe linux-admin" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html