Re: sshd: PAM pam_set_item: NULL pam handle passed
From: Chris Faulhaber (jedgar@fxp.org)Date: 03/09/02
- Previous message: Dan Uscatu: "nouser - rootkit ?"
- In reply to: Matt Zimmerman: "sshd: PAM pam_set_item: NULL pam handle passed"
- Next in thread: Matt Zimmerman: "Re: sshd: PAM pam_set_item: NULL pam handle passed"
- Reply: Matt Zimmerman: "Re: sshd: PAM pam_set_item: NULL pam handle passed"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 8 Mar 2002 18:30:46 -0500 From: Chris Faulhaber <jedgar@fxp.org> To: incidents@securityfocus.com
On Thu, Mar 07, 2002 at 10:29:32PM -0500, Matt Zimmerman wrote:
> I got these just now, from OpenSSH_3.0.2p1 Debian 1:3.0.2p1-8. There is no
> user smw on my system, and there never has been. It doesn't look like there
> was a compromise. Otherwise, it looks like someone connecting to the wrong
> IP address, but I have not seen this PAM error before. Has anyone else seen
> this kind of activity?
>
...
> Mar 7 21:50:22 mizar sshd[15396]: PAM pam_set_item: NULL pam handle passed
This can happen if someone ssh's to a machine then ^C's out of ssh
when asked for the password. I see this on FreeBSD 4.x (whose PAM
implementation is based on LinuxPAM):
Mar 8 18:27:08 merlin sshd[34674]: pam_set_item: NULL pam handle passed
-- Chris D. Faulhaber - jedgar@fxp.org - jedgar@FreeBSD.org -------------------------------------------------------- FreeBSD: The Power To Serve - http://www.FreeBSD.org
- application/pgp-signature attachment: stored
- Previous message: Dan Uscatu: "nouser - rootkit ?"
- In reply to: Matt Zimmerman: "sshd: PAM pam_set_item: NULL pam handle passed"
- Next in thread: Matt Zimmerman: "Re: sshd: PAM pam_set_item: NULL pam handle passed"
- Reply: Matt Zimmerman: "Re: sshd: PAM pam_set_item: NULL pam handle passed"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
