Hi Richard,
First of all thank you guys for replying!
Here is the output of ldd:
==- 8< -========================================================================
fireball# ldd /usr/lib/pam_unix.so
/usr/lib/pam_unix.so:
libutil.so.5 => /lib/libutil.so.5 (0x28167000)
libcrypt.so.3 => /lib/libcrypt.so.3 (0x28173000)
libypclnt.so.2 => /usr/lib/libypclnt.so.2 (0x2818b000)
libpam.so.3 => /usr/lib/libpam.so.3 (0x2818f000)
fireball# ldd /usr/lib/pam_unix.so.3
/usr/lib/pam_unix.so.3:
libutil.so.5 => /lib/libutil.so.5 (0x28167000)
libcrypt.so.3 => /lib/libcrypt.so.3 (0x28173000)
libypclnt.so.2 => /usr/lib/libypclnt.so.2 (0x2818b000)
libpam.so.3 => /usr/lib/libpam.so.3 (0x2818f000)
==- 8< -========================================================================
As for when it stopped working - the first thing I did is trying to recall if I
updated any ports.
I've even went so far as looking for all files in /usr/ modified within the
date range, but no,
nothing.
I did update php5 couple days before that. But it still worked for about two
days after that.
And I don't have apache/php opened to outside anyway. Just mail ports and ssh
on high port (closed
it for now for just in case anyway).
Victor
>> ====- 8< -===================================================
>> su: in openpam_load_module(): no pam_unix.so found
>> su: pam_start: system error
>> ====- 8< -===================================================
>>
>> pam_unix.so is in /usr/lib:
>> ====- 8< -===================================================
>> # ls -l /usr/lib/pam_unix*
>> lrwxr-xr-x 1 root wheel 13 Sep 25 2006 /usr/lib/pam_unix.so ->
>> pam_unix.so.3
>> -r--r--r-- 1 root wheel 10240 Feb 19 2007 /usr/lib/pam_unix.so.3
>> # file /usr/lib/pam_unix.so
>> /usr/lib/pam_unix.so: symbolic link to `pam_unix.so.3'
>> ====- 8< -===================================================
> First, this is how a problem should be described, great work.
> When openpam can't load a module, it also print's the 'not found' message.
> With 'ldd /usr/lib/pam_unix.so.3' you can see if all the libraries that
> it needs are in place. On my systems it give's the following output:
> $ ldd /usr/lib/pam_unix.so.3
> /usr/lib/pam_unix.so.3:
> libutil.so.5 => /lib/libutil.so.5 (0x28169000)
> libcrypt.so.3 => /lib/libcrypt.so.3 (0x28175000)
> libypclnt.so.2 => /usr/lib/libypclnt.so.2 (0x2818d000)
> libpam.so.3 => /usr/lib/libpam.so.3 (0x28191000)
>> ====- 8< -===================================================
>> Sep 18 11:11:37 xxxxxx su: BAD SU <myloginname> to root on /dev/ttyp3
>> Sep 18 11:13:46 xxxxxx sshd[45047]: Bad protocol version identification
>> '\377\364\377\375\006quit' from <some ip here>
>> Sep 18 11:15:08 xxxxxx sshd[45056]: Received disconnect from <some ip here>:
>> 2: Bad packet length 710099706.
>> ====- 8< -===================================================
> The first line is probably the result of the broken pam_unix.so, the
> other two lines look to me as ssh bruteforce attacks.
> But, when did it stopped working. Did you tried to update the world or
> something like that?
--
Best regards,
Victor
_______________________________________________
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
