This week my system had a problem, and although it is now solved, I would
like to know if anyone can explain it to me.
On a Monday afternoon it was reported to me that who and finger were not
working, although users could login and access their accounts. I also found
that when I used the "last" command, the output was rather stange, with
many login dates showing Dec. 31.
I consulted with a local Linux administrator who spent some time looking
into the problem with me looking over his sholder. He found that the
/bin/login file was very large. He copied the same file from another linux
box that was not having this problem in to the one that was (replacing the
old one), and voila! Everything worked fine. Musta been the login file. But
why?
One post I found in deja news suggested a hacker might have done this, but
we have no other evidence of a hacker. I also found out later that the
machine had been inadvertantly restarted without being properly shut
down--perhaps this was the cause of the screwed-up login file. However, I
have had my machine shutdown from power failures before an not had this
problem arise afterward.
Has anyone had this problem before, and does anyone have an idea was to
what might have caused this large corrupted login file? I would like to
know how to avoid it in the future.
Thanks for your help!
-Ken
