pam problem

Suddenly and without any obvious reason a problem with pam came up in a red
hat 9 linux server system. The result is that the users cannot be
authenticated by the system and the mail server (while working) does not
take any action for them. Any ideas about the problem and how can it be
solved?

thank you

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NotDashEscaped: You need GnuPG to verify this message

In comp.os.linux.networking Giwrgos Tsirogiannis <(E-Mail Removed)>:
> Suddenly and without any obvious reason a problem with pam came up in a red
> hat 9 linux server system. The result is that the users cannot be
> authenticated by the system and the mail server (while working) does not
> take any action for them. Any ideas about the problem and how can it be
> solved?

Perhaps if you don't mind showing us the relevant lines out of
your logs in /var/log/, interesting should be "maillog"/"mail",
"secure", "messages" and alike.

--
Michael Heiming (GPG-Key ID: 0xEDD27B94)
mail: echo (E-Mail Removed) | perl -pe 'y/a-z/n-za-m/'
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBatCeAkPEju3Se5QRAnjNAJwK7JYuwvdHm1vfFjSpyR 5JdXSGmACgpEHP
JREAqENY1AiBXusdpPlH2gk=
=vJPV
-----END PGP SIGNATURE-----

Excerpts froms secure log file showing the point of the failure:

Oct 11 10:21:23 cancer xinetd[1281]: START: imap pid=1631
from=147.102.20.131

Oct 11 10:23:07 cancer sshd[1269]: Server listening on 0.0.0.0 port 22.

Oct 11 10:27:43 cancer xinetd[1283]: START: imap pid=1654
from=147.102.222.65

Oct 11 10:27:53 cancer xinetd[1283]: EXIT: imap pid=1654 duration=10(sec)

Oct 11 10:29:07 cancer sshd[1270]: Server listening on 0.0.0.0 port 22.

Oct 11 10:32:00 cancer sshd[1649]: PAM unable to
dlopen(/lib/security/pam_stack.so)

Oct 11 10:32:00 cancer sshd[1649]: PAM [dlerror: /lib/security/pam_stack.so:
cannot open shared object file: Not a directory]

Oct 11 10:32:00 cancer sshd[1649]: PAM adding faulty module:
/lib/security/pam_stack.so

Oct 11 10:32:00 cancer sshd[1649]: PAM unable to
dlopen(/lib/security/pam_nologin.so)

Oct 11 10:32:00 cancer sshd[1649]: PAM [dlerror:
/lib/security/pam_nologin.so: cannot open shared object file: Not a
directory]

Oct 11 10:32:00 cancer sshd[1649]: PAM adding faulty module:
/lib/security/pam_nologin.so

Oct 11 10:32:00 cancer sshd[1649]: PAM unable to
dlopen(/lib/security/pam_limits.so)

Oct 11 10:32:00 cancer sshd[1649]: PAM [dlerror:
/lib/security/pam_limits.so: cannot open shared object file: Not a
directory]

Oct 11 10:32:00 cancer sshd[1649]: PAM adding faulty module:
/lib/security/pam_limits.so

Oct 11 10:32:00 cancer sshd[1649]: PAM unable to
dlopen(/lib/security/pam_console.so)

Oct 11 10:32:00 cancer sshd[1649]: PAM [dlerror:
/lib/security/pam_console.so: cannot open shared object file: Not a
directory]

Oct 11 10:32:00 cancer sshd[1649]: PAM adding faulty module:
/lib/security/pam_console.so

Oct 11 10:32:00 cancer sshd[1649]: PAM unable to
dlopen(/lib/security/$ISA/pam_deny.so)

Oct 11 10:32:00 cancer sshd[1649]: PAM [dlerror:
/lib/security/../../lib/security/pam_deny.so: cannot open shared object
file: Not a directory]

Oct 11 10:32:00 cancer sshd[1649]: PAM adding faulty module:
/lib/security/$ISA/pam_deny.so

Oct 11 10:32:00 cancer sshd[1649]: Failed password for root from
147.102.20.131 port 1133

Oct 11 10:32:30 cancer last message repeated 3 times

Oct 11 10:36:51 cancer xinetd[1284]: START: imap pid=1671
from=147.102.222.65

Oct 11 10:37:00 cancer xinetd[1284]: EXIT: imap pid=1671 duration=9(sec)

Thank you

"Michael Heiming" <michael+(E-Mail Removed)> wrote in message
news:vtvq32-(E-Mail Removed)...
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> NotDashEscaped: You need GnuPG to verify this message
>
> In comp.os.linux.networking Giwrgos Tsirogiannis <(E-Mail Removed)>:
> > Suddenly and without any obvious reason a problem with pam came up in a
red
> > hat 9 linux server system. The result is that the users cannot be
> > authenticated by the system and the mail server (while working) does not
> > take any action for them. Any ideas about the problem and how can it be
> > solved?
>
> Perhaps if you don't mind showing us the relevant lines out of
> your logs in /var/log/, interesting should be "maillog"/"mail",
> "secure", "messages" and alike.
>
> --
> Michael Heiming (GPG-Key ID: 0xEDD27B94)
> mail: echo (E-Mail Removed) | perl -pe 'y/a-z/n-za-m/'
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.4 (GNU/Linux)
>
> iD8DBQFBatCeAkPEju3Se5QRAnjNAJwK7JYuwvdHm1vfFjSpyR 5JdXSGmACgpEHP
> JREAqENY1AiBXusdpPlH2gk=
> =vJPV
> -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NotDashEscaped: You need GnuPG to verify this message

In comp.os.linux.networking Giwrgos Tsirogiannis <(E-Mail Removed)>:
> Thank you

> "Michael Heiming" <michael+(E-Mail Removed)> wrote in message
>> In comp.os.linux.networking Giwrgos Tsirogiannis <(E-Mail Removed)>:
>> > Suddenly and without any obvious reason a problem with pam came up in a
> red
>> > hat 9 linux server system. The result is that the users cannot be
>> > authenticated by the system and the mail server (while working) does not
>> > take any action for them. Any ideas about the problem and how can it be
>> > solved?
>>
>> Perhaps if you don't mind showing us the relevant lines out of
>> your logs in /var/log/, interesting should be "maillog"/"mail",

> Excerpts froms secure log file showing the point of the failure:

> Oct 11 10:21:23 cancer xinetd[1281]: START: imap pid=1631
> from=147.102.20.131

> Oct 11 10:23:07 cancer sshd[1269]: Server listening on 0.0.0.0 port 22.

> Oct 11 10:27:43 cancer xinetd[1283]: START: imap pid=1654
> from=147.102.222.65

> Oct 11 10:27:53 cancer xinetd[1283]: EXIT: imap pid=1654 duration=10(sec)

> Oct 11 10:29:07 cancer sshd[1270]: Server listening on 0.0.0.0 port 22.

> Oct 11 10:32:00 cancer sshd[1649]: PAM unable to
> dlopen(/lib/security/pam_stack.so)

> Oct 11 10:32:00 cancer sshd[1649]: PAM [dlerror: /lib/security/pam_stack.so:
> cannot open shared object file: Not a directory]

> Oct 11 10:32:00 cancer sshd[1649]: PAM adding faulty module:
> /lib/security/pam_stack.so

> Oct 11 10:32:00 cancer sshd[1649]: PAM unable to
> dlopen(/lib/security/pam_nologin.so)

> Oct 11 10:32:00 cancer sshd[1649]: PAM [dlerror:
> /lib/security/pam_nologin.so: cannot open shared object file: Not a
> directory]

> Oct 11 10:32:00 cancer sshd[1649]: PAM adding faulty module:
> /lib/security/pam_nologin.so

> Oct 11 10:32:00 cancer sshd[1649]: PAM unable to
> dlopen(/lib/security/pam_limits.so)

> Oct 11 10:32:00 cancer sshd[1649]: PAM [dlerror:
> /lib/security/pam_limits.so: cannot open shared object file: Not a
> directory]

> Oct 11 10:32:00 cancer sshd[1649]: PAM adding faulty module:
> /lib/security/pam_limits.so

> Oct 11 10:32:00 cancer sshd[1649]: PAM unable to
> dlopen(/lib/security/pam_console.so)

> Oct 11 10:32:00 cancer sshd[1649]: PAM [dlerror:
> /lib/security/pam_console.so: cannot open shared object file: Not a
> directory]

> Oct 11 10:32:00 cancer sshd[1649]: PAM adding faulty module:
> /lib/security/pam_console.so

> Oct 11 10:32:00 cancer sshd[1649]: PAM unable to
> dlopen(/lib/security/$ISA/pam_deny.so)

> Oct 11 10:32:00 cancer sshd[1649]: PAM [dlerror:
> /lib/security/../../lib/security/pam_deny.so: cannot open shared object
> file: Not a directory]

> Oct 11 10:32:00 cancer sshd[1649]: PAM adding faulty module:
> /lib/security/$ISA/pam_deny.so

> Oct 11 10:32:00 cancer sshd[1649]: Failed password for root from
> 147.102.20.131 port 1133

Looks quite strange, I'd take a look at www.chkrootkit.org, and
test your system if you haven't been cracked already. Failing
that, it seems someone damaged the pam package, files or/and
configuration, I'd save the config (/etc/pam.d) and reinstall the
pam rpm package.

Added comp.os.linux.security to the receiver.

--
Michael Heiming (GPG-Key ID: 0xEDD27B94)
mail: echo (E-Mail Removed) | perl -pe 'y/a-z/n-za-m/'
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBbbG8AkPEju3Se5QRAvozAJ0cPFubOXsvjBfRsiuljs oGe3ZOWwCgk8DV
hI/bHiryZARnMD3m0maylxQ=
=ldw9
-----END PGP SIGNATURE-----