Re: [cobalt-users] [RAQ4] I got something strange while SU in the first time.

[Tong Narak <tong@xxxxxxxxxxx>]

su - root  still  auto press something in the first time.




Last login: Sun Feb 29 15:05:15 2004 from b148ppp64.ksc.net.com
*****************************************************************
*                                                               *
* Type 'pine' or 'mail' to read your email                      *
*                                                               *
* Type 'cd web' to access your personal web page                *
* Type 'cd ../../web' to access the site web                    *
* Type 'cd ../../ftp' to access the anonymous FTP site          *
* Type 'cd' to return to your home directory                    *
*                                                               *
* Type 'exit' to end this session                               *
*                                                               *
*****************************************************************
4:38:07am admin pts/1 ~ 501 >                             <------- these line automatic occur
4:38:07am admin pts/1 ~ 501 > su - root
Password:                                                   <-------something enter automatic
su: incorrect password
4:38:13am admin pts/1 ~ 502 > su - root
Password:                                                      <---- 2nd is work normal
4:38:25am root pts/1 ~ 501 # cd /etc
4:38:29am root pts/1 /etc 502 # cd pam.d
4:38:34am root pts/1 /etc/pam.d 504 # cat su
#%PAM-1.0
auth       required     /lib/security/pam_wheel.so
auth       sufficient   /lib/security/pam_rootok.so
auth       required     /lib/security/pam_pwdb.so shadow nullok
account    required     /lib/security/pam_pwdb.so
session    required     /lib/security/pam_pwdb.so
4:38:55am root pts/1 /etc/pam.d 505 # cat su.master
#%PAM-1.0
auth       required     /lib/security/pam_wheel.so
auth       sufficient   /lib/security/pam_rootok.so
auth       required     /lib/security/pam_pwdb.so shadow nullok
account    required     /lib/security/pam_pwdb.so
session    required     /lib/security/pam_pwdb.so
4:40:18am root pts/1 /etc/pam.d 506 # cat chsh
#%PAM-1.0
auth       sufficient   /lib/security/pam_rootok.so
auth       required     /lib/security/pam_pwdb.so shadow nullok
account    required     /lib/security/pam_pwdb.so
password   required     /lib/security/pam_cracklib.so retry=3 type=login
password   required     /lib/security/pam_pwdb.so shadow md5 nullok use_authtok
session    required     /lib/security/pam_pwdb.so
4:41:02am root pts/1 /etc/pam.d 507 # cat sshd
#%PAM-1.0
auth       required     /lib/security/pam_pwdb.so shadow nodelay
auth       required     /lib/security/pam_nologin.so
account    required     /lib/security/pam_pwdb.so
password   required     /lib/security/pam_cracklib.so
password   required     /lib/security/pam_pwdb.so shadow nullok use_authtok
session    required     /lib/security/pam_pwdb.so
session    required     /lib/security/pam_limits.so
4:41:29am root pts/1 /etc/pam.d 508 # 


Thank for advance
Tong



> 
> > > That is probably PAM issue.
> > > Try
> > > su - root
> > > It should work from the first time.
> > >
> > > WBR,
> > > Dmitry
> >
> > Can we fix these permamant ?
> 
> Does su - root work? 
> If yes, it can be fixed... 
> Please publish here your /etc/pam.d/su file
> 
> It should look this way:
> [admin admin]$ cat /etc/pam.d/su
> #%PAM-1.0
> auth       required     /lib/security/pam_wheel.so
> auth       sufficient   /lib/security/pam_rootok.so
> auth       required     /lib/security/pam_pwdb.so shadow nullok
> account    required     /lib/security/pam_pwdb.so
> session    required     /lib/security/pam_pwdb.so
> 
> WBR,
> Dmitry