[cobalt-users] RE: RAQ3 check pass; user unknown - Again

["Render-Vue" <sales@xxxxxxxxxxxxxx>]

gsh replied...

>>In any case, the error logs for apache WILL show access failures for
password protected pages, the admin logs will show them for the admin
areas....<<

Just checked them out and again nothing ties in with the times :<
have checked the access log, the adm_error and the error

>>There is a logging module for pam, but it's not installed by default,
dunno how hard it would be to stick in, messing with PAm is horribly
dangerous unless the machine is sitting next to you ;)<<

The servers in the States and I'm here in Auckland New Zealand - don't think
I'll try that one (hee hee)

>>Do you have any cgi's that might be trying to do their own
authentication? That message is from pam_pwdb, which handles also, the
default requests for login/passwords (eg, non service specific)
ssh?<<

The only SSH activity on the logs is when I go in myself

>>Also, the timestamps in your log are interesting, they have a regular
pattern....<<

That's the concerning part - wouldn't be so concerned if it was the odd one
here and there

Anyway thanks for the reply gsh

Chae