LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 04-15-2004, 09:58 AM   #1
mdavis
LQ Newbie
 
Registered: Sep 2003
Distribution: Redhat 9 & Fedora Core 2
Posts: 15

Rep: Reputation: 0
/var/log/messages full of these messages. Should I be concerned?


pam_timestamp_check: pam_timestamp: '/var/run/' owner UID !=0
last message repeated 7 times
last message repeated 13 times
last message repeated 13 times
last message repeated 13 times
last message repeated 13 times
last message repeated 13 times
last message repeated 13 times
vsftpd: warening: can't get client address: Bad file descriptor


and it goes on and on

These messages were all logged within 5 minutes of each other.

Should this concern me?

thanks,
Michael
 
Old 04-15-2004, 11:23 AM   #2
ugge
Senior Member
 
Registered: Dec 2000
Location: Gothenburg, SWEDEN
Distribution: OpenSUSE 10.3
Posts: 1,028

Rep: Reputation: 45
The repeat message only tels you that the message happened more times than what is written to the log. This behavior is to shorten down the log files.

If the original message is a message of concern, then these additional are of course of concern too.
 
Old 04-15-2004, 11:28 AM   #3
mdavis
LQ Newbie
 
Registered: Sep 2003
Distribution: Redhat 9 & Fedora Core 2
Posts: 15

Original Poster
Rep: Reputation: 0
Thanks ugge,

Sorry - the 'last message repeated xx times' errors were included just to show how often I am receiving them.

The lines in question are the lines beginning with 'PAM_' & 'VSFTP'. Should I be concerned about those two lines in particular?

thanks,
Michael
 
Old 04-15-2004, 11:32 AM   #4
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
Well, check the permissions on /var/run

$ ls -ld /var/run

see who the owner is (apparently it's not root). If it's a totally unexpected users, your system might have been compromised, or more likely a bad software install changed the owner of that directory and you just need to change it back.

# chown root /var/run
 
Old 04-15-2004, 03:41 PM   #5
mdavis
LQ Newbie
 
Registered: Sep 2003
Distribution: Redhat 9 & Fedora Core 2
Posts: 15

Original Poster
Rep: Reputation: 0
It was owned my mysql. Probably believable.

I CHOWNed it to root and that fixed the error. Thanks.

Any ideas on the 'vsftpd: warning: can't get client address: Bad file descriptor" error message? I get that message almost exactly every 10 minutes.

Just got a new message as well. 'http: gethostby*.getanswer: asked for "www.teenmodel-manu.com in AAAA" got type "A"

and NO - teenmodel-manu.com is NOT my domain. :-)

thanks for any advise you can give.
Michael
 
Old 04-16-2004, 10:08 AM   #6
mdavis
LQ Newbie
 
Registered: Sep 2003
Distribution: Redhat 9 & Fedora Core 2
Posts: 15

Original Poster
Rep: Reputation: 0
Found and fixed the VSFTP error message. Apparently VSFTP.conf has to be changed to turn off TCPWrapper from YES to NO. There is some compatability issue with them turned on.

Thanks for your help.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
what does messages suppressed in /var/log/messages mean saavik Linux - Networking 2 05-07-2008 02:31 PM
Redirecting the kernel messages to file other than /var/log/messages jyotika_b83 Linux - General 3 04-28-2005 06:39 PM
From where am i getting error messages to /var/log/messages? prabhuacsp Programming 3 02-16-2005 08:59 AM
From where am i getting error messages to /var/log/messages? prabhuacsp Linux - Networking 1 02-16-2005 12:34 AM
/var/log/messages ? juanb Linux - General 1 10-18-2003 05:32 AM


All times are GMT -5. The time now is 06:01 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration