GDM log ' Bad User' 36945 times!
Randy
toucan at tropicalrain.us
Tue Jan 11 14:18:26 UTC 2005
Hello,
When I woke up this morning and checked the logs, I found that I've
been getting :
Jan 11 07:55:32 io gdm-binary[3071]: Couldn't authenticate user
Jan 11 07:55:32 io gdm(pam_unix)[3071]: bad username []
Once a second, ever second, since early yesterday. Logwatch says
there were 36945 of these entries, and it has been continuing this
morning. I've checked gdm.conf. It will not accept remote
connections. I restricted it a bit further. The firewall was already
configured to deny all external connections except to port 80 from one
specific IP. I tried killing the gdm processes. They simply re-spawn.
Finally, I rebooted. This stopped the errors. Does anyone have any
idea what was happening? Was it an attack, or a gdm bug?
Regards,
Randy
More information about the users
mailing list