Re: only root allowed login ...

On Sat, Jun 11, 2011 at 08:46, terry white <[email protected]> wrote:
> =A0 =A0all of a sudden, i am only able to login as root. =A0this is n=
ot something

Computers are deterministic machines.  Nothing happens 'all of the sudd=
en'.

The "Have you recently dicked with" checklist:
1) pam
2) ulimits
3) permissions
4) selinux
5) /etc/passwd
6) .bashrc .bash_profile /etc/profile*
7) df -h (Is the disk full)

> =A0 =A0as a given, login as a valid user, with correct password, term=
inated
> immediately, with a new login prompt. =A0invalid login attempts itera=
te until
> a new session initiated.

Sounds like a shell related problem if it seems to instantaneously log
in and then kick you back out.  check the .bashrc .bash_profile
/etc/profile* files for recent modifications.  See if setting a user's
shell to something else (csh, ksh, zsh, ash) makes a difference.

> =A0 =A0ftp, and smtp allowed, telnet fails.

Telnet should fail.  It does sound like a malicious attacker has
compromised your system though, because that's the only way
authenticated FTP would be working.  And I hope to got you're using
TLS on smtp.

> =A0 =A0i'm not seeing anything mentioned in the logs with regard to f=
ailed
> normal user login. =A0 i'm at a loss as to where i might start lookin=
g.

Which logs have you checked so far?
--
To unsubscribe from this list: send the line "unsubscribe linux-admin" =
in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html