GDM log ' Bad User' 36945 times!

Randy toucan at tropicalrain.us
Tue Jan 11 14:18:26 UTC 2005


Hello,
   When I woke up this morning and checked the logs, I found that I've 
been getting :

Jan 11 07:55:32 io gdm-binary[3071]: Couldn't authenticate user
Jan 11 07:55:32 io gdm(pam_unix)[3071]: bad username []

  Once a second, ever second, since early yesterday.  Logwatch says 
there were 36945 of these entries, and it has been continuing this 
morning.  I've checked gdm.conf.  It will not accept remote 
connections.  I restricted it a bit further.  The firewall was already 
configured to deny all external connections except to port 80 from one 
specific IP.  I tried killing the gdm processes.  They simply re-spawn.
   Finally, I rebooted.  This stopped the errors.  Does anyone have any 
idea what was happening?  Was it an attack, or a gdm bug?

Regards,
Randy




More information about the users mailing list