Re: auth log
In article <[EMAIL PROTECTED]> you wrote: > Does any body know what this is mean: > > su[32278]: + ??? root-nobody > > I found this line in my auth.log file. It means some root process has used su to drop priveledges and become nobody. cron jobs are known to do that. Gruss Bernd -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: auth log
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 2005.01.26 23:23, Juan Pablo Lopez Ponce De Leon wrote: Does any body know what this is mean: su[32278]: + ??? root-nobody Probably a cron job that was run with the less privileged identity of nobody instead of root. Nothing to worry about, really... Best regards, Andreas -BEGIN PGP SIGNATURE- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQFB+HvlAB00fZdcFyQRApNnAKC6r7FIQGDCBAt448iscETGOv9e+QCgs7KJ QrvsmAwjA7v70IsKSc3qFzg= =k700 -END PGP SIGNATURE-
auth log
Hello, Does any body know what this is mean: su[32278]: + ??? root-nobody I found this line in my auth.log file. Thank Juan Pablo Lopez P.
RE: strange auth log
I rather think of a problem with a PS/2 and VGA switch-box failing or rebooting. Do you run GPM on your machine? Maybe it can have prblems when the PS/2 mouse is disconnected or when the switch reboots. I've seen that before (rather with Win9X, I daresay) -Original Message- From: Répási Tibor [SMTP:[EMAIL PROTECTED] Sent: lundi 7 janvier 2002 15:24 To: Debian-Security Mailing list Subject:RE: strange auth log This box is hosted in a hosting center, I thing there aren't any cats or other animals. It is a possibility that somebody droped his coat or something else to the keyboard, but a more important question is, why crashes the system so that it needed a hw reset to restart? I don't find any other non-regular log entries. Syslogs last headbeat in messages was at 19:42. -Eredeti üzenet- Feladó: Phillip Hofmeister [mailto:[EMAIL PROTECTED] Küldve: Monday, January 07, 2002 2:53 PM Címzett: [EMAIL PROTECTED] Másolatot kap: debian-security@lists.debian.org Tárgy: Re: strange auth log These messages would seem to suggest someone was pounding on your terminal keyboard trying to log in. The blank bad user names I would assume means no user name was entered. The p[d[d[c[c`...,,mmnnbbb and ^IZCXCGH^[[19~ would lead me to believe there was a furry animal running around your keyboard. Do you have a cat? If you know no one had physical access to your computer at the time of these log messages then I would not rule out other issues. I could speculate as to what these issues could be but I think the scenario I provided is among the most probable. Phil -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED] -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
RE: strange auth log
This box is hosted in a hosting center, I thing there aren't any cats or other animals. It is a possibility that somebody droped his coat or something else to the keyboard, but a more important question is, why crashes the system so that it needed a hw reset to restart? I don't find any other non-regular log entries. Syslogs last headbeat in messages was at 19:42. -Eredeti üzenet- Feladó: Phillip Hofmeister [mailto:[EMAIL PROTECTED] Küldve: Monday, January 07, 2002 2:53 PM Címzett: [EMAIL PROTECTED] Másolatot kap: debian-security@lists.debian.org Tárgy: Re: strange auth log These messages would seem to suggest someone was pounding on your terminal keyboard trying to log in. The blank bad user names I would assume means no user name was entered. The p[d[d[c[c`...,,mmnnbbb and ^IZCXCGH^[[19~ would lead me to believe there was a furry animal running around your keyboard. Do you have a cat? If you know no one had physical access to your computer at the time of these log messages then I would not rule out other issues. I could speculate as to what these issues could be but I think the scenario I provided is among the most probable. Phil -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: strange auth log
These messages would seem to suggest someone was pounding on your terminal keyboard trying to log in. The blank bad user names I would assume means no user name was entered. The p[d[d[c[c`...,,mmnnbbb and ^IZCXCGH^[[19~ would lead me to believe there was a furry animal running around your keyboard. Do you have a cat? If you know no one had physical access to your computer at the time of these log messages then I would not rule out other issues. I could speculate as to what these issues could be but I think the scenario I provided is among the most probable. Phil -Original Message- From: Répási Tibor <[EMAIL PROTECTED]> To: "Debian-Security Mailing list" Date: Mon, 7 Jan 2002 08:27:53 +0100 Subject: strange auth log Hi there, I've some strange lines in my auth.log : Jan 5 19:45:57 panda PAM_unix[500]: bad username [ ] Jan 5 19:46:00 panda login[500]: FAILED LOGIN (1) on `tty1' FOR `UNKNOWN', User not known to the underlying authentication module Jan 5 19:46:05 panda PAM_unix[500]: bad username [ ] Jan 5 19:46:07 panda login[500]: FAILED LOGIN (2) on `tty1' FOR `UNKNOWN', User not known to the underlying authentication module Jan 5 19:46:12 panda PAM_unix[500]: bad username [ ] Jan 5 19:46:14 panda login[500]: FAILED LOGIN (3) on `tty1' FOR `UNKNOWN', User not known to the underlying authentication module Jan 5 19:46:32 panda PAM_unix[500]: bad username [^IZCXCGH^[[19~ ] Jan 5 19:46:35 panda login[500]: FAILED LOGIN (4) on `tty1' FOR `UNKNOWN', User not known to the underlying authentication module Jan 5 19:48:22 panda PAM_unix[2729]: bad username [[p[d[d[c[c `...,,mmnnbbb] Anybody an idea what this is? I'm running potato with kernel 2.2.20, and these are the last lines in the log before my linux box crashed, after 19:48 any connection to the host was timeed out. Greetings, Tibor -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
RE: strange auth log
I rather think of a problem with a PS/2 and VGA switch-box failing or rebooting. Do you run GPM on your machine? Maybe it can have prblems when the PS/2 mouse is disconnected or when the switch reboots. I've seen that before (rather with Win9X, I daresay) -Original Message- From: Répási Tibor [SMTP:[EMAIL PROTECTED]] Sent: lundi 7 janvier 2002 15:24 To: Debian-Security Mailing list Subject:RE: strange auth log This box is hosted in a hosting center, I thing there aren't any cats or other animals. It is a possibility that somebody droped his coat or something else to the keyboard, but a more important question is, why crashes the system so that it needed a hw reset to restart? I don't find any other non-regular log entries. Syslogs last headbeat in messages was at 19:42. -Eredeti üzenet- Feladó: Phillip Hofmeister [mailto:[EMAIL PROTECTED]] Küldve: Monday, January 07, 2002 2:53 PM Címzett: [EMAIL PROTECTED] Másolatot kap: [EMAIL PROTECTED] Tárgy: Re: strange auth log These messages would seem to suggest someone was pounding on your terminal keyboard trying to log in. The blank bad user names I would assume means no user name was entered. The p[d[d[c[c`...,,mmnnbbb and ^IZCXCGH^[[19~ would lead me to believe there was a furry animal running around your keyboard. Do you have a cat? If you know no one had physical access to your computer at the time of these log messages then I would not rule out other issues. I could speculate as to what these issues could be but I think the scenario I provided is among the most probable. Phil -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED] -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED] -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
RE: strange auth log
This box is hosted in a hosting center, I thing there aren't any cats or other animals. It is a possibility that somebody droped his coat or something else to the keyboard, but a more important question is, why crashes the system so that it needed a hw reset to restart? I don't find any other non-regular log entries. Syslogs last headbeat in messages was at 19:42. -Eredeti üzenet- Feladó: Phillip Hofmeister [mailto:[EMAIL PROTECTED]] Küldve: Monday, January 07, 2002 2:53 PM CÃmzett: [EMAIL PROTECTED] Másolatot kap: [EMAIL PROTECTED] Tárgy: Re: strange auth log These messages would seem to suggest someone was pounding on your terminal keyboard trying to log in. The blank bad user names I would assume means no user name was entered. The p[d[d[c[c`...,,mmnnbbb and ^IZCXCGH^[[19~ would lead me to believe there was a furry animal running around your keyboard. Do you have a cat? If you know no one had physical access to your computer at the time of these log messages then I would not rule out other issues. I could speculate as to what these issues could be but I think the scenario I provided is among the most probable. Phil -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED] -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: strange auth log
These messages would seem to suggest someone was pounding on your terminal keyboard trying to log in. The blank bad user names I would assume means no user name was entered. The p[d[d[c[c`...,,mmnnbbb and ^IZCXCGH^[[19~ would lead me to believe there was a furry animal running around your keyboard. Do you have a cat? If you know no one had physical access to your computer at the time of these log messages then I would not rule out other issues. I could speculate as to what these issues could be but I think the scenario I provided is among the most probable. Phil -Original Message- From: Répási Tibor <[EMAIL PROTECTED]> To: "Debian-Security Mailing list" <[EMAIL PROTECTED]> Date: Mon, 7 Jan 2002 08:27:53 +0100 Subject: strange auth log Hi there, I've some strange lines in my auth.log : Jan 5 19:45:57 panda PAM_unix[500]: bad username [ ] Jan 5 19:46:00 panda login[500]: FAILED LOGIN (1) on `tty1' FOR `UNKNOWN', User not known to the underlying authentication module Jan 5 19:46:05 panda PAM_unix[500]: bad username [ ] Jan 5 19:46:07 panda login[500]: FAILED LOGIN (2) on `tty1' FOR `UNKNOWN', User not known to the underlying authentication module Jan 5 19:46:12 panda PAM_unix[500]: bad username [ ] Jan 5 19:46:14 panda login[500]: FAILED LOGIN (3) on `tty1' FOR `UNKNOWN', User not known to the underlying authentication module Jan 5 19:46:32 panda PAM_unix[500]: bad username [^IZCXCGH^[[19~ ] Jan 5 19:46:35 panda login[500]: FAILED LOGIN (4) on `tty1' FOR `UNKNOWN', User not known to the underlying authentication module Jan 5 19:48:22 panda PAM_unix[2729]: bad username [[p[d[d[c[c `...,,mmnnbbb] Anybody an idea what this is? I'm running potato with kernel 2.2.20, and these are the last lines in the log before my linux box crashed, after 19:48 any connection to the host was timeed out. Greetings, Tibor -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED] -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: strange auth log
On Mon, 7 Jan 2002 08:27:53 +0100 R <[EMAIL PROTECTED]> wrote: > Hi there, > > I've some strange lines in my auth.log : > > Jan 5 19:45:57 panda PAM_unix[500]: bad username [ ] > Jan 5 19:46:00 panda login[500]: FAILED LOGIN (1) on `tty1' FOR `UNKNOWN', > User not known to the underlying authentication module > Jan 5 19:46:05 panda PAM_unix[500]: bad username [ ] > Jan 5 19:46:07 panda login[500]: FAILED LOGIN (2) on `tty1' FOR `UNKNOWN', > User not known to the underlying authentication module > Jan 5 19:46:12 panda PAM_unix[500]: bad username [ ] > Jan 5 19:46:14 panda login[500]: FAILED LOGIN (3) on `tty1' FOR `UNKNOWN', > User not known to the underlying authentication module > Jan 5 19:46:32 panda PAM_unix[500]: bad username [^IZCXCGH^[[19~ ] > Jan 5 19:46:35 panda login[500]: FAILED LOGIN (4) on `tty1' FOR `UNKNOWN', > User not known to the underlying authentication module > Jan 5 19:48:22 panda PAM_unix[2729]: bad username [[p[d[d[c[c > `...,,mmnnbbb] > > Anybody an idea what this is? I'm running potato with kernel 2.2.20, and > these are the last lines in the log before my linux box crashed, after 19:48 > any connection to the host was timeed out. > > Greetings, > > Tibor > I'm most interested by this part: `...,,mmnnbbb which is in a straight line of keys on the keyboard.. Do you have a cat? Luke
strange auth log
Hi there, I've some strange lines in my auth.log : Jan 5 19:45:57 panda PAM_unix[500]: bad username [ ] Jan 5 19:46:00 panda login[500]: FAILED LOGIN (1) on `tty1' FOR `UNKNOWN', User not known to the underlying authentication module Jan 5 19:46:05 panda PAM_unix[500]: bad username [ ] Jan 5 19:46:07 panda login[500]: FAILED LOGIN (2) on `tty1' FOR `UNKNOWN', User not known to the underlying authentication module Jan 5 19:46:12 panda PAM_unix[500]: bad username [ ] Jan 5 19:46:14 panda login[500]: FAILED LOGIN (3) on `tty1' FOR `UNKNOWN', User not known to the underlying authentication module Jan 5 19:46:32 panda PAM_unix[500]: bad username [^IZCXCGH^[[19~ ] Jan 5 19:46:35 panda login[500]: FAILED LOGIN (4) on `tty1' FOR `UNKNOWN', User not known to the underlying authentication module Jan 5 19:48:22 panda PAM_unix[2729]: bad username [[p[d[d[c[c `...,,mmnnbbb] Anybody an idea what this is? I'm running potato with kernel 2.2.20, and these are the last lines in the log before my linux box crashed, after 19:48 any connection to the host was timeed out. Greetings, Tibor
Re: strange auth log
On Mon, 7 Jan 2002 08:27:53 +0100 R <[EMAIL PROTECTED]> wrote: > Hi there, > > I've some strange lines in my auth.log : > > Jan 5 19:45:57 panda PAM_unix[500]: bad username [ ] > Jan 5 19:46:00 panda login[500]: FAILED LOGIN (1) on `tty1' FOR `UNKNOWN', > User not known to the underlying authentication module > Jan 5 19:46:05 panda PAM_unix[500]: bad username [ ] > Jan 5 19:46:07 panda login[500]: FAILED LOGIN (2) on `tty1' FOR `UNKNOWN', > User not known to the underlying authentication module > Jan 5 19:46:12 panda PAM_unix[500]: bad username [ ] > Jan 5 19:46:14 panda login[500]: FAILED LOGIN (3) on `tty1' FOR `UNKNOWN', > User not known to the underlying authentication module > Jan 5 19:46:32 panda PAM_unix[500]: bad username [^IZCXCGH^[[19~ ] > Jan 5 19:46:35 panda login[500]: FAILED LOGIN (4) on `tty1' FOR `UNKNOWN', > User not known to the underlying authentication module > Jan 5 19:48:22 panda PAM_unix[2729]: bad username [[p[d[d[c[c > `...,,mmnnbbb] > > Anybody an idea what this is? I'm running potato with kernel 2.2.20, and > these are the last lines in the log before my linux box crashed, after 19:48 > any connection to the host was timeed out. > > Greetings, > > Tibor > I'm most interested by this part: `...,,mmnnbbb which is in a straight line of keys on the keyboard.. Do you have a cat? Luke -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
strange auth log
Hi there, I've some strange lines in my auth.log : Jan 5 19:45:57 panda PAM_unix[500]: bad username [ ] Jan 5 19:46:00 panda login[500]: FAILED LOGIN (1) on `tty1' FOR `UNKNOWN', User not known to the underlying authentication module Jan 5 19:46:05 panda PAM_unix[500]: bad username [ ] Jan 5 19:46:07 panda login[500]: FAILED LOGIN (2) on `tty1' FOR `UNKNOWN', User not known to the underlying authentication module Jan 5 19:46:12 panda PAM_unix[500]: bad username [ ] Jan 5 19:46:14 panda login[500]: FAILED LOGIN (3) on `tty1' FOR `UNKNOWN', User not known to the underlying authentication module Jan 5 19:46:32 panda PAM_unix[500]: bad username [^IZCXCGH^[[19~ ] Jan 5 19:46:35 panda login[500]: FAILED LOGIN (4) on `tty1' FOR `UNKNOWN', User not known to the underlying authentication module Jan 5 19:48:22 panda PAM_unix[2729]: bad username [[p[d[d[c[c `...,,mmnnbbb] Anybody an idea what this is? I'm running potato with kernel 2.2.20, and these are the last lines in the log before my linux box crashed, after 19:48 any connection to the host was timeed out. Greetings, Tibor -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
