Re: Strange auth.log entry
> the **unknown* is due to if there is not a correct uid (number) match to a
> username (your login name) in /etc/passwd. I only know this because of a bug
> in the dialy server I use (connectd) which didn't for whatever reason collect
> the correct uid for the user 'nobody'. Obviously something (maybe in yer
> cron job or an application running as root) is trying to lower its privilages
> but failing. It could be a normal application (such as apache) trying to
> change its userid to 'www-data' only to find its not there. Look out for
> these kind of things.
>
> As for the 4704 I think if I'm correct that is the PID (process id, use top
> or ps ax to find out) that tried to lower its privilages. When you see this
> error again do a 'ps ax' and see if you can match up the 'upset' application.
I see entries like this when someone attempts to log into the machine (i.e.
with telnet) but doesn't enter a username. Off the top of my head, I can't
remember whether I get this entry when I goof up an ssh login or not. I just
remember seeing it for telnet. That might be easy to reproduce... or maybe
you remember goofing up a login that you can correlate to this entry?
KEN
--
Kenneth J. Pronovici <pronovic@ieee.org>
Personal Homepage: http://www.skyjammer.com/~pronovic/
"They that can give up essential liberty to obtain a little
temporary safety deserve neither liberty nor safety."
- Benjamin Franklin, Historical Review of Pennsylvania, 1759
Reply to: