GDM log ' Bad User' 36945 times!I had this symptom as a result of an overnight yum update.

[Tony Dietrich]

I had this symptom as a result of an overnight yum update.

Even worse, local users couldn't log in.  GDM tried to start, but hung before 
the login screen was displayed. Those same log messages were the only visible 
sign of what was happening.

Unfortunately, it was a standalone working machine belonging to our senior 
partner, so I didn't have time to investigate .. all I could do in the time I 
had available before they got back and needed it was save the data/home 
directories and re-install, then upgrade again from the yup archives. (which 
I also managed to save, thank heavens.)

Tony


On Tuesday 11 Jan 2005 14:18, Randy wrote:
> Hello,
>    When I woke up this morning and checked the logs, I found that I've
> been getting :
>
> Jan 11 07:55:32 io gdm-binary[3071]: Couldn't authenticate user
> Jan 11 07:55:32 io gdm(pam_unix)[3071]: bad username []
>
>   Once a second, ever second, since early yesterday.  Logwatch says
> there were 36945 of these entries, and it has been continuing this
> morning.  I've checked gdm.conf.  It will not accept remote
> connections.  I restricted it a bit further.  The firewall was already
> configured to deny all external connections except to port 80 from one
> specific IP.  I tried killing the gdm processes.  They simply re-spawn.
>    Finally, I rebooted.  This stopped the errors.  Does anyone have any
> idea what was happening?  Was it an attack, or a gdm bug?
>
> Regards,
> Randy

-- 
Tony Dietrich
-------------
Love -- the last of the serious diseases of childhood.