0

We are using Ubuntu 16.04 and have commented out few users in passwd configuration but the authentication log shows successful login attempts from those users.

The point is we have specifically specified which users can login to OS and also have commented out few users but we still receive successful login attempts from those disabled users in Ubuntu but after investigation we notice nothing (No Bash History and Last Login is also months back) while the login is today.

Any Idea or comments please !

Alphax01
  • 11

1 Answers1

1

If i comment out one of my user in /etc/passwd and try to login with it, the auth.log sais:

Sep 24 14:23:08 myhost sshd[1178]: Invalid user Xuser from 1.2.3.4
Sep 24 14:23:08 myhost sshd[1178]: input_userauth_request: invalid user Xuser [preauth]
Sep 24 14:23:11 myhost sshd[1178]: pam_unix(sshd:auth): check pass; user unknown
Sep 24 14:23:11 myhost sshd[1178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=remotehost.co.x

Manual edit of /etc/passwd and shadow is not recommended btw, do instead usermod -L Xuser instead. usermod -U Xuser unlocks the disbled account.

One possible scene i can think of is there is another user directory installed where the same users exists too. I mean something like LDAP or NIS/YP.

n3ko
  • 239