Re: Non root users account logins terminating within 10 seconds

[Aaron Gray <angray beeb net>]

James Wilkinson wrote:

Aaron Gray wrote:
  

Just logged in to be told my account had terminated within 10 seconds.
Root is okay but new accounts terminate.

Oh. Logging in from remote over SSH they are fine.

The only things that I have done recently is to change the SELinux
permissions to Permissive from disabled and back again. Oh and install
ies4Linux in root but that should not effect anything.

Oh. and failsafe mode logs into the account okay.
    

I'm not familiar with ies4Linux -- from where did you get it, and how
does it install? (Is there an install script, an RPM, or do you just
un-tar it?)
  

Its an install script that installs MS Internet Explorer on Wine for a single user.

       http://www.tatanka.com.br/ies4linux/index-en.html

I seriously doubt whether it was the culprit.

Then there's always rpm -Va, possibly piped through grep
(e.g. rpm -Va | grep -E ^..5 to show all files with a modified md5sum)
to see which files have been modified on the system.

Hope this helps,
  

Thanks, thats a useful command sequence :)

Nothing strikingly obvious though. I have ISPConfig ( A web and email configuration program) installed too which is the most likely cuprit for altering these files. I'll check through them tomorrow.

S.5....T. c /etc/ppp/chap-secrets
S.5....T. c /etc/ppp/pap-secrets
S.5....T. c /etc/postfix/main.cf
S.5....T. c /usr/lib/sasl2/smtpd.conf
SM5....T. c /etc/sysconfig/iptables-config
S.5....T. c /etc/syslog.conf
..5....T. c /etc/sysconfig/system-config-users
..5....T. c /etc/inittab
S.5....T. c /etc/sysconfig/named
S.5....T. c /root/.bashrc
S.5....T. c /etc/httpd/conf/httpd.conf
S.5....T.   /etc/sgml/docbook-slides.cat
S.5....T. c /etc/sysconfig/kdump
S.5....T. c /etc/httpd/conf.d/php.conf
..5....T.   /usr/share/eclipse/configuration/org.eclipse.update/last.config.stamp
S.5....T.   /usr/share/eclipse/configuration/org.eclipse.update/platform.xml
S.5....T.   /usr/share/eclipse/features/org.eclipse.sdk_3.1.2/feature.xml
S.5....T. c /etc/sysconfig/system-config-securitylevel
S.5....T. c /etc/printcap
S.5....T. c /etc/xml/catalog
S.5....T. c /usr/share/sgml/docbook/xmlcatalog
S.5....T. c /usr/share/a2ps/afm/fonts.map
S.5....T.   /etc/sgml/docbook-simple.cat
S.5....T.   /usr/share/texmf-var/web2c/latex.fmt
S.5....T.   /usr/share/texmf-var/web2c/pdflatex.fmt
S.5....T. c /etc/cups/cupsd.conf
S.5....TC c /etc/cups/mime.types
S.5....TC c /usr/lib/security/classpath.security
S.5....T. c /var/log/mail/statistics
S.5....T. c /etc/sane.d/dll.conf
S.5....T. c /etc/ftpusers
S.5....T. c /etc/proftpd.conf
..5....T.   /usr/bin/rsvg
S.5....T.   /usr/bin/rsvg-convert
S.5....T.   /usr/bin/rsvg-view
S.5....T.   /usr/lib/gtk-2.0/2.4.0/engines/libsvg.so
S.5....T.   /usr/lib/gtk-2.0/2.4.0/loaders/svg_loader.so


Whole list :-

S.5....T. c /etc/ppp/chap-secrets
S.5....T. c /etc/ppp/pap-secrets
S.5....T. c /etc/postfix/main.cf
S.5....T. c /usr/lib/sasl2/smtpd.conf
SM5....T. c /etc/sysconfig/iptables-config
S.5....T. c /etc/syslog.conf
..5....T. c /etc/sysconfig/system-config-users
..5....T. c /etc/inittab
S.5....T. c /etc/sysconfig/named
S.5....T. c /root/.bashrc
S.5....TC   /usr/share/texmf-var/fonts/map/dvipdfm/updmap/dvipdfm_dl14.map
S.5....TC   /usr/share/texmf-var/fonts/map/dvipdfm/updmap/dvipdfm_ndl14.map
S.5....TC   /usr/share/texmf-var/fonts/map/pdftex/updmap/pdftex_dl14.map
S.5....TC   /usr/share/texmf-var/fonts/map/pdftex/updmap/pdftex_ndl14.map
S.5....T.   /usr/share/texmf-var/web2c/aleph.fmt
S.5....T.   /usr/share/texmf-var/web2c/amstex.fmt
S.5....T.   /usr/share/texmf-var/web2c/bamstex.fmt
S.5....T.   /usr/share/texmf-var/web2c/bplain.fmt
S.5....T.   /usr/share/texmf-var/web2c/cont-en.fmt
S.5....T.   /usr/share/texmf-var/web2c/etex.fmt
S.5....T.   /usr/share/texmf-var/web2c/lambda.fmt
S.5....T.   /usr/share/texmf-var/web2c/lamed.fmt
..5....T.   /usr/share/texmf-var/web2c/metafun.mem
S.5....T.   /usr/share/texmf-var/web2c/mf.base
..5....T.   /usr/share/texmf-var/web2c/mpost.mem
S.5....T.   /usr/share/texmf-var/web2c/mptopdf.fmt
S.5....T.   /usr/share/texmf-var/web2c/omega.fmt
S.5....T.   /usr/share/texmf-var/web2c/pdfetex.fmt
S.5....T.   /usr/share/texmf-var/web2c/pdftex.fmt
S.5....T.   /usr/share/texmf-var/web2c/tex.fmt
S.5....T. c /etc/httpd/conf/httpd.conf
S.5....T.   /etc/sgml/docbook-slides.cat
S.5....TC   /usr/share/texmf-var/fonts/map/dvips/updmap/builtin35.map
S.5....TC   /usr/share/texmf-var/fonts/map/dvips/updmap/download35.map
S.5....TC   /usr/share/texmf-var/fonts/map/dvips/updmap/ps2pk.map
S.5....TC   /usr/share/texmf-var/fonts/map/dvips/updmap/psfonts_pk.map
S.5....TC   /usr/share/texmf-var/fonts/map/dvips/updmap/psfonts_t1.map
S.5....T. c /etc/sysconfig/kdump
S.5....T. c /etc/httpd/conf.d/php.conf
..5....T.   /usr/share/eclipse/configuration/org.eclipse.update/last.config.stamp
S.5....T.   /usr/share/eclipse/configuration/org.eclipse.update/platform.xml
S.5....T.   /usr/share/eclipse/features/org.eclipse.sdk_3.1.2/feature.xml
S.5....T. c /etc/sysconfig/system-config-securitylevel
S.5....T. c /etc/printcap
S.5....T. c /etc/xml/catalog
S.5....T. c /usr/share/sgml/docbook/xmlcatalog
S.5....T. c /usr/share/a2ps/afm/fonts.map
S.5....T.   /etc/sgml/docbook-simple.cat
S.5....T.   /usr/share/texmf-var/web2c/latex.fmt
S.5....T.   /usr/share/texmf-var/web2c/pdflatex.fmt
S.5....T. c /etc/cups/cupsd.conf
S.5....TC c /etc/cups/mime.types
S.5....TC c /usr/lib/security/classpath.security
S.5....T. c /var/log/mail/statistics
S.5....T. c /etc/sane.d/dll.conf
S.5....T. c /etc/ftpusers
S.5....T. c /etc/proftpd.conf
..5....T.   /usr/bin/rsvg
S.5....T.   /usr/bin/rsvg-convert
S.5....T.   /usr/bin/rsvg-view
S.5....T.   /usr/lib/gtk-2.0/2.4.0/engines/libsvg.so
S.5....T.   /usr/lib/gtk-2.0/2.4.0/loaders/svg_loader.so

Many thanks for the suggestion. I wish I had known about it before and had backups of these files.

Aaron