0

We are using Ubuntu 16.04 and have commented out few users in passwd configuration but the authentication log shows successful login attempts from those users.

The point is we have specifically specified which users can login to OS and also have commented out few users but we still receive successful login attempts from those disabled users in Ubuntu but after investigation we notice nothing (No Bash History and Last Login is also months back) while the login is today.

Any Idea or comments please !

Alphax01
  • 11
  • What type of login are you seeing? Local, SSH, Samba? Could it perhaps be some sort of leftover script, so there's no interactive shell? – Arronical Sep 24 '19 at 11:58
  • Following is a copy of the log Sep 23 10:26:14 APPS1-DB sshd[49028]: Accepted password for UserX from 20.20.20.20 port 49721 ssh2 Sep 23 10:26:14 APPS1-DB sshd[49028]: pam_unix(sshd:session): session opened for user UserX by (uid=0) Sep 23 10:26:14 APPS1-DB systemd-logind[2627]: New session 5360 of user UserX.

    In reality, The user has already been commented (Disabled) and from others side specific users are only allowed to login via ssh but this user is not allowed. After investigation there is no bash history for this user and also the last login is months back.

     – Alphax01 Sep 24 '19 at 12:13
  • Better to [edit] your question to include that. – Arronical Sep 24 '19 at 12:44
  • 2
    Please [edit] your question and add this information using proper formatting, it's difficult to read in a comment. – Organic Marble Sep 24 '19 at 12:44

1 Answers1

1

If i comment out one of my user in /etc/passwd and try to login with it, the auth.log sais:

Sep 24 14:23:08 myhost sshd[1178]: Invalid user Xuser from 1.2.3.4
Sep 24 14:23:08 myhost sshd[1178]: input_userauth_request: invalid user Xuser [preauth]
Sep 24 14:23:11 myhost sshd[1178]: pam_unix(sshd:auth): check pass; user unknown
Sep 24 14:23:11 myhost sshd[1178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=remotehost.co.x

Manual edit of /etc/passwd and shadow is not recommended btw, do instead usermod -L Xuser instead. usermod -U Xuser unlocks the disbled account.

One possible scene i can think of is there is another user directory installed where the same users exists too. I mean something like LDAP or NIS/YP.

n3ko
  • 239