This is my first attempt to post here, so I hope that I am going about it properly. Please feel free to correct and/or point me in the right direction if you see any problems with my post(s).

Problem: After entering any User and Password (valid or not) the process hangs indefinitely.

Notes: Both normal logins (remote or via console)and ftp are hanging; Samba is acting fine; rebooting corrected the issue until today; server has been up without (recent) adjustments for over a year; otherwise server seems normal (although without the ability to login, this is pretty meaningless).

If anyone out there has a plan of attack for this your advice is more than welcome. I am fairly green when it comes to the guts of Linux, so dont assume too much

Thanks!

Hello,

First, which distro you use ???
have you do an update recently ???

Further analysis: in single user mode I can manually launch all (at least the obvious ones that I need; network, ftp, ssh, samba, cron) services without issue. I can then access the server normally, logging in and using ftp remotely... However, these same services do not function if the server is brought up in multi-user mode as they all 'hang' after asking for a password.

Oliv: It is running Redhat and has had no recent updates.

Which version of RedHat?

Could you post the content of your /etc/inittab file ???

-rw-r--r-- 1 root devel 1696 Sep 6 2004 /etc/inittab

id:3:initdefault:

# System initialization.
si::sysinit:/etc/rc.d/rc.sysinit

l0:0:wait:/etc/rc.d/rc 0
l1:1:wait:/etc/rc.d/rc 1
l2:2:wait:/etc/rc.d/rc 2
l3:3:wait:/etc/rc.d/rc 3
l4:4:wait:/etc/rc.d/rc 4
l5:5:wait:/etc/rc.d/rc 5
l6:6:wait:/etc/rc.d/rc 6

# Trap CTRL-ALT-DELETE
ca::ctrlaltdel:/sbin/shutdown -t3 -r now

# When our UPS tells us power has failed, assume we have a few minutes
# of power left. Schedule a shutdown for 2 minutes from now.
# This does, of course, assume you have powerd installed and your
# UPS connected and working correctly.
pf::powerfail:/sbin/shutdown -f -h +2 "Power Failure; System Shutting Down"

# If power was restored before the shutdown kicked in, cancel it.
pr:12345:powerokwait:/sbin/shutdown -c "Power Restored; Shutdown Cancelled"


# Run gettys in standard runlevels
1:2345:respawn:/sbin/mingetty tty1
2:2345:respawn:/sbin/mingetty tty2
3:2345:respawn:/sbin/mingetty tty3
4:2345:respawn:/sbin/mingetty tty4
5:2345:respawn:/sbin/mingetty tty5
6:2345:respawn:/sbin/mingetty tty6
7:2345:off:/sbin/mgetty ttyS0

# Run xdm in runlevel 5
x:5:respawn:/etc/X11/prefdm -nodaemon

Hope this tells you which version, if not please let me know how to get that info for you guys...

(joeneedshelp on bustedserver) ~ $ uname -a
Linux bustedserver.mycompanyname.com 2.4.21-32.0.1.ELsmp #1 SMP Tue May 17 17:52:23 EDT 2005 i686 i686 i386 GNU/Linux

Look into the logs (/var/log/messages) and see if there are messages about failed login etc.

Also, which filesystem do you have? (mount output will show it).

have you tried to run "chkrootkit" to be sure that you have not been hacked and that no exec like "mingetty" has been infected ???
see this site to find it: http://www.chkrootkit.org/

Oliv'

Mara: I have looked at my ../messages log and see nothing unusual with respect to access and failures.

Oliv: I have not attempted to run anything. I will see what that tells me, although I have checked every file that I can think of in this pathway for size and permission reasonability - they all appear good. This is further backed up by the fact that I can login normally once all processes are started by launching the things I need manually from single user mode.

Mara: filesystems are 'ext3' I think.

I was rather thinking about a case of incorrect shutdown/poweroff, when a filesystem may break, something may be overwritten etc. Browse the log searching for things that may be caused by that.

It means it's only about runlevel? Are you sure the scripts in /etc/rc.d are all correct?

Mara:
logs: I reviewed the message and other log files looking for anything unusual. I validated each entry that I did not immediately recognize and understand by looking at several client's machines files for similar messages. I could not find anything out of place.
/etc/rc.d: I pulled my entire /etc directory from backup from a time period when mulit-user bootup still functioned and I get this same thing. I reviewed this file initially to make sure it was not 'blanked' out somehow, or something similar and found nothing unusual here...

Another possibly interesting note here is that when this started to happen the first time, I was logged in to this machine and got a call from a remote employee that he could not login. I then opened another session to see what his trouble was about when I got my first 'hang'. At that point a reboot 'fixed' the trouble and I moved on. This repeated itself 2 days later in a similar fashion and was again fixed with a reboot. However, after about the 5th time (over about 10 days) the reboot did nothing to correct or help, and here I am.

What was your rection when the hand happened? Hard reboot or any kind of a normal shutdown?

Mara: After the phone call from my guy about not being able to login I entered <CTRL><ALT><DEL> from the console (since I also could not get any new sessions - although my current sessions were OK) and got a normal shutdown. I watched everything come offline and only saw the usual failures (/var unmount failure, etc.), nothing I have not seen before and nothing I thought to note. -THANK YOU FOR TAKING THE TIME HERE Mara, I really appreciate that.