Tuc at T-B-O-H.NET wrote:

Jul 18 14:08:47 asgard nologin: Attempted login by root on UNKNOWN
Something running *as* root is trying to "su" to an account which has /bin/nologin as a shell

e.g. # su avahi

cartman nologin: Attempted login by alex on /dev/ttyp7

avahi:*:558:558:Avahi Daemon User:/nonexistent:/sbin/nologin

If it were running detached from a terminal (in the background; started from an rc script) then it would have no terminal to report, hence UNKNOWN.

Tracking down what, is another matter. ps uagx and kill processes one by one until the message stops! Or try ktracing suspects for a less drastic approach.


freebsd-questions@freebsd.org mailing list
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to