Hello,

Today sudenly, I can not login on the server machine.
After typing a lot of usernames it always waits then shows:
"login timed out after 60 secondes"
All software on the server work perfectly and are accesible on network: database, nfs, ping respond, etc..

The day before the display cord was disconnected also there is no possible way to shutdown properly and I was forced to poweroff by shuting down he power supply. For hours the server worked without login possibility because there was no monitor.

I boot the server with a bootcd to repair all partitions (e2fsck -fv) but no change.

Please tell me what happens and how to repair it.

Thank you

That's just plain wrong behaviour to start with. Either you know the user account name and use that or you don't. At which point you go retrieve it, not "type a lot of usernames".


That depends on what you show us. If it's your server then you should know (or investigate) if you run pam_faillock, fail2ban or any other passive or active response tools. Also check lastlog, last, lastb, system and daemon logs in /var/log for clues.

User "root" or any other user shows the same problems.

/var/log/lastlog contains suspicious data. There are many '@' like this:

@@@@@@ LU/dev/tty1 @@@@ GU/dev/tty2@@@@@@@@@-?U/dev/pts/0@@@@

I checked /var/log/messages /var/log/dmesg /var/log/syslog but nothing wrong.
Other files seem ok: /etc/passwd /etc/shadow

I copy /var/log/lastlog to another machine and try to understand what it contains: root user is connected on /dev/tty when I power on the first time the server this morning. Strange! at this moment I did not type any thing because the monitor was still disconnected. Also, until now I reboot the machine several time. I run the server at 9AM; now is 05PM

"/var/log/lastlog" is (a sparse binary file) meant to be read by 'lastlog'. Also note you have not indicated that you have checked all I pointed out.