su: incorrect password
 

Hi,

I hope someone can help. I have done a search for other similar threads and tried their suggestions.

To replicate the problem, this is what I do.

1) Open a putty session with the server
2) Log in as root
3) su - someuser

After executing the su command, I get the error "su: incorrect password". This is happening with all users. No users can log in directly using putty either.

The only change made to the server recently was that subversion was installed by one of the users.

The nsswitch.conf file specifies "files ldap" as the order for passwd, shadow, etc, so that looks ok.

I've had a look at the /etc/pam.d/su file and others, but they don't make any sense to me. I just can't figure out why this has happened and can't think of any reason for subversion to have made a change.

I have also tried creating a new user using "useradd testuser" and then "passwd testuser" to set the password and then "su - testuser". That also fails and testuser can't log in directly using ssh either. I am sure the password is correct, so there is something else wrong.

Can someone please help with some more ideas.

Cheers,
MrHyde77

Is the 'su' command still setuid and owned by root?

ls -l `which su`

So, as root you're not able to switch to any other user? That is very strange.

• Is the /etc/shadow file corrupt, and is the file permissions set properly?
• Are you running SElinux?
• Can you backtrace exactly which command the user who installed svn run?
• Does /var/log/messages report anything?

Its not just su that is stuffed as none of the users can ssh into the box, so I feel it is something to do with users.

Some answers from the questions raised:

# ls -l `which su`
-rwsr-xr-x 1 root root 52770 Oct 6 2004 /bin/su

Is the /etc/shadow file corrupt, and is the file permissions set properly?
The permissions on the file are 700 and its contents look ok.

Are you running SElinux?
SELinux is enforcing. However, I don't really need it - so can disable if needed.

Can you backtrace exactly which command the user who installed svn run?
No. He is currently on leave, so can't ask him.

Does /var/log/messages report anything?
This is interesting. /var/log/messages shows the following line:
Jan 6 17:27:31 minerva nss_wins[6120]: pam_ldap: error trying to bind (Invalid credentials)

However, the nsswitch.conf file says "files ldap". Shouldn't it be checking the local system first before ldap. And I am interested to know why ldap is there is the first place. We don't have any ldap server in our environment. Do you know if svn uses/requires ldap?

Thanks for the help guys.

Cheers

Could you try and set selinux to "permissive", and see what happens?

Does this help?

There is a thread here that may give you a way in.

http://www.linuxquestions.org/questi...d-10.1-680626/