Arch Linux

sula

Member

Registered: 2005-08-07

Posts: 93

Can log in console.Weird.

I'm posting this in newbie ,because this is ridiculous ,must be some easy fix. But really it is first time i encounter that kind of problem.

I can't log in in any console(except X based one) ,it doesen't matter if as root or user. When i try to ,and type password in ,nothing happens i can only Crtl +C to terminate logging. But that is not everything. Syslo-ng and login processes are using very much of CPU.
Just see by yourself:

http://img222.imageshack.us/img222/9436 … nu5bu7.jpg
http://img525.imageshack.us/img525/2626 … nu3pr2.jpg (two login attempts at same time)

I can log to Kde via KDM without problems ,also sudoing to root in X console is no problem.
My arch is up to date , i'm not using testing or unstable or any custom repository. Running beyond kernel ,but as it is the same kernel for at least 1 month(don't remember correctly) i don't think that is problem.

Really don't know what to do.

iphitus

Forum Fellow

From: Melbourne, Australia

Registered: 2004-10-09

Posts: 4,927

Re: Can log in console.Weird.

check the log files in /var/log for clues, if syslog'd is running like that, then there's bound to be some heavy logging going on.

sula

Member

Registered: 2005-08-07

Posts: 93

Re: Can log in console.Weird.

Hey ,thank you very much for your attention.

I feel i haven't said clear one thing. It is not that syslog is using 30-50% Cpu all the time. It is using Cpu like that only when I try to log in via console. I know that if it would be running like that without my action it could = someone brute forcing me. But this not it(i think).

I checked var/log (lol i'm silly that i haven't done that earlier) and auth.log and errors.log have 500 MB each!!!

They are spammed with one kind of line:
May  6 13:14:08 localhost pam_access[3039]: /etc/security/access.conf: line 281019: missing newline or line too long
May  6 13:14:08 localhost pam_access[3039]: /etc/security/access.conf: line 281020: missing newline or line too long
May  6 13:14:08 localhost pam_access[3039]: /etc/security/access.conf: line 281021: missing newline or line too long

Times tells me that this kind of log is generated only when i try to login via console (ie Crtl +Alt +F1...)

Some kind of bug?

patroclo7

Member

From: Bassano del Grappa, ITALY

Registered: 2006-01-11

Posts: 915

Re: Can log in console.Weird.

Well, inspect /etc/security/access.conf, it is meant to allow/disallow log in for certain users on certain consoles. In the arch pam default installation, everything is commented out in that file, but may be it is screwed in someway. Anyway, do not feel stupid: pam is a powerful but often mysterious tool!

---

Mortuus in anima, curam gero cutis

sula

Member

Registered: 2005-08-07

Posts: 93

Re: Can log in console.Weird.

Now i'm seriousely worried. Something is really fu....d up or something is screwing my box. Access.conf file is reported to have 12 054 723,5 TB lol , opening it is impossible Using of CPU goes to 100% and after 30 minutes i have wait nothing changed. Now can someone post his or default access.conf ,or if i delete mine new(default one) will create automaticaly?

patroclo7

Member

From: Bassano del Grappa, ITALY

Registered: 2006-01-11

Posts: 915

Re: Can log in console.Weird.

Delete it immediately without worries, in particular if you did never customize it consciously. Then reinstall the package it belongs to, in order to have back the default access.conf (which is fully commented out, thus irrelevant).

pacman -S pam

It will complain about the package already installed, but you can reply that you want to reinstall it anyway.

I do not know what can have corrupted the file. I am not a security expert, but, if you have never opened that file (its syntax is not so simple, so if you have opened it you are likely to have screwed its syntax), then may be you should suspect some intrusion in your system: in fact no external process should write to that file.

---

Mortuus in anima, curam gero cutis

ataraxia

Member

From: Pittsburgh

Registered: 2007-05-06

Posts: 1,553

Re: Can log in console.Weird.

It seems a rather unlikely file for an attacker to write garbage onto - after all, it will just make it harder for the attacker to log in.

I'd suspect hard disk or filesystem corruption, myself.