Re: [cobalt-users] [RAQ4] I got something strange while SU in the first time.

[Tong Narak <tong@xxxxxxxxxxx>]

> And what it writes in /var/log/messages ? 
> 
> > su - root  still  auto press something in the first time.
> 
> WBR,
> Dmitry

Nothing in /var/log/messages  but I found something in /var/log/auth


Last login: Tue Mar  2 09:51:37 2004 from 203.209.116.34
*****************************************************************
*                                                               *
* Type 'pine' or 'mail' to read your email                      *
*                                                               *
* Type 'cd web' to access your personal web page                *
* Type 'cd ../../web' to access the site web                    *
* Type 'cd ../../ftp' to access the anonymous FTP site          *
* Type 'cd' to return to your home directory                    *
*                                                               *
* Type 'exit' to end this session                               *
*                                                               *
*****************************************************************
10:01:56am admin pts/1 ~ 501 > 
10:01:57am admin pts/1 ~ 501 > su
Password: 
su: incorrect password
10:02:20am admin pts/1 ~ 502 > su
Password: 
10:02:32am admin pts/1 /home/sites/home/users/admin 501 # tail /var/log/auth
Mar  2 10:01:52 www sshd[28373]: Could not reverse map address 203.209.116.34.
Mar  2 10:01:53 www sshd[28373]: Accepted password for admin from 203.209.116.34 port 2093 ssh2
Mar  2 10:01:56 www PAM_pwdb[28375]: (sshd) session opened for user admin by (uid=110)
Mar  2 10:01:56 www sshd[28376]: error: open /dev/tty failed - could not set controlling tty: Permission denied
Mar  2 10:02:20 www PAM_pwdb[28406]: authentication failure; admin(uid=110) -> root for su service
Mar  2 10:02:32 www PAM_pwdb[28407]: (su) session opened for user root by admin(uid=110)
10:02:46am admin pts/1 /home/sites/home/users/admin 502 #