I am have a DNS server running Redhat 6.2. The server and all services run just fine, but I am unabe to logon using any user name including root. When I try to logon I get a message that flashes very fast that says "incorrect logon" and returns to the logon prompt. Any help would be appreciated.

Thanks in Advance

Laidback

did you try to boot into single user mode?

I am able to boot in single user mode. I can even change the password for root , but when I boot to normal mode I have the same problem "incorrect logon" flashes and returns to logon prompt.

I have seen this before, sorry I can not help. All I did was reinstall the system.

Something's wrong there .
Try to boot in single mode and then check your login, ls, ps and others (I can't remember witch files) files, check the files size and compare that dimension with the original files from your linux instalation CD.

I think that you are hacked, if I'm not wrong.
I think that you are infected with root kit.

I got that problem ones and that was the problem.

Single mode bootup was ok and I replace the infected filez with original ... and all was ok finally.

If I'm not wrong you got "t00rn rootkit" worm.
Check your /usr/src directory and see if there is some t00rn directory.

Search for rootkit checking program to the internet and scan in single mode your linux machine.

If I'm wrong ... sorry.
If there is a worm please post and message here and give me an response to this problem.

Regards.

If you boot in that single mode .... you MUST replace the infected files with original. Don't make any other modification there.

Search on the internet about t00rn rootkit and some programs witch can delete or find that worm.
On the internet you can find that program and with it you can scan that linux machine.

You don't need to reinstall all there just replace some files.
If you can find documentation about t00rn rootkit there are witch files must be replaced on your linux machine.

Regards.

Hi..



Boot in single user mode.
Check ur PAM modules and the configuratons.

Add the following entires in syslog to route all the logs to virtual console F10

*.* /dev/tty10


Reboot the machine. Now u can see all the logs in Alt F10.

Try login and see the logs in Alt F10. It may help u to find out the problem.


Try to use Tripware for integrity


Siddiqu.T