[NCLUG] help! can't login!

Sat Mar 24 08:56:51 MST 2001

Well, I had some weird hard drive IRQ timeouts on Thursday,
and when I tried to unlock my X screen on Friday morning, it
wouldn't let me in.  I tried to login to a virtual console, but i
won't let me do that either.

I rebooted, and when it automatically dropped into single user
mode to let me run fsck to fix a bunch of bad inodes, it apparently
didn't fix things all the way.  I still can't login.  I keep getting
messages
in my /var/log/messages about "user unknown."  This sounds an
awful lot like the Ramen or Lion worm, but I've checked for any
of the telltale signs (like directories, files, etc. listed as being
infected),
and after installing to a different hard drive from a Redhat 6 CD,
and mounting the old drive, I find that a diff of my executables like
ls, login, etc., are all the same.  In other words, I think it really
might
have been a hard drive error.

So I want to just reinstate the files that are apparently corrupted,
so I can then just rsync to another hard drive (SCSI this time), and
use the new drive as my root.

I tried reinstalling the rpm for pam-0.72-6 off of the Redhat CD,
using the --relocate and --badreloc options.  It seemed to install
fine, but when I switched my old hard drive back into place, it still
wouldn't let me login.

What files do I still need to make sure are correct, beyond pam and
the /etc/passwd file?  (I'm not currently shadowing, so there's
no /etc/shadow.)

Any ideas?

Regards,
   Daniel   (daniel.herrington at home.com)

By the way, here's a snippet of my /var/log/messages:

Mar 22 04:02:00 c229885-d anacron[533]: Updated timestamp for job
`cron.daily' to 2001-03-22
Mar 22 04:06:38 c229885-d PAM_pwdb[663]: (su) session opened for user
news by (uid=0)
Mar 22 04:06:38 c229885-d PAM_pwdb[663]: (su) session closed for user
news
Mar 22 12:05:43 c229885-d kernel: hde: timeout waiting for DMA
Mar 22 12:05:43 c229885-d kernel: ide_dmaproc: chipset supported
ide_dma_timeout func only: 14
Mar 22 12:05:43 c229885-d kernel: hde: irq timeout: status=0xd0 { Busy }

Mar 22 12:05:43 c229885-d kernel: hde: DMA disabled
Mar 22 12:05:43 c229885-d kernel: ide2: reset: success
Mar 22 14:09:08 c229885-d sshd[2691]: log: Connection from
156.153.255.171 port 57691
Mar 22 14:09:12 c229885-d sshd[2691]: log: Password authentication for
daniel accepted.
Mar 22 14:21:33 c229885-d sshd[2691]: log: Closing connection to
156.153.255.171
Mar 22 14:43:23 c229885-d sshd[799]: log: Generating new 768 bit RSA
key.
Mar 22 14:43:23 c229885-d sshd[799]: log: RSA key generation complete.
Mar 22 16:46:52 c229885-d sshd[3213]: log: Connection from
156.153.255.163 port 59855
Mar 22 16:46:54 c229885-d sshd[3213]: log: Password authentication for
daniel accepted.
Mar 22 16:56:01 c229885-d kernel: hde: status error: status=0x58 {
DriveReady SeekComplete DataRequest }
Mar 22 16:56:01 c229885-d kernel: hde: drive not ready for command
Mar 22 17:38:35 c229885-d sshd[3213]: log: Closing connection to
156.153.255.163
Mar 22 17:43:23 c229885-d sshd[799]: log: Generating new 768 bit RSA
key.
Mar 22 17:43:24 c229885-d sshd[799]: log: RSA key generation complete.
Mar 22 21:46:48 c229885-d kernel: attempt to access beyond end of device

Mar 22 21:46:48 c229885-d kernel: 21:06: rw=0, want=1022425484,
limit=7172991
Mar 22 21:46:48 c229885-d kernel: dev 21:06 blksize=4096
blocknr=792477282 sector=2044850960 size=4096 count=1
Mar 22 21:46:48 c229885-d kernel: attempt to access beyond end of device

Mar 22 21:46:48 c229885-d kernel: 21:06: rw=0, want=1371127196,
limit=7172991
Mar 22 21:46:48 c229885-d kernel: dev 21:06 blksize=4096
blocknr=1953394534 sector=-1552712912 size=4096 count=1
Mar 22 21:46:48 c229885-d kernel: attempt to access beyond end of device

Mar 22 21:46:48 c229885-d kernel: 21:06: rw=0, want=1022425484,
limit=7172991
Mar 22 21:46:48 c229885-d kernel: dev 21:06 blksize=4096
blocknr=792477282 sector=2044850960 size=4096 count=1
Mar 22 22:35:54 c229885-d kernel: EXT2-fs error (device ide2(33,6)):
ext2_free_blocks: Freeing blocks not in datazone - block = 792477281,
count = 1
Mar 22 22:35:54 c229885-d kernel: EXT2-fs error (device ide2(33,6)):
ext2_free_blocks: Freeing blocks not in datazone - block = 1953394534,
count = 1
Mar 22 22:35:54 c229885-d kernel: EXT2-fs error (device ide2(33,6)):
ext2_free_blocks: Freeing blocks not in datazone - block = 1631324734,
count = 1
Mar 22 22:35:54 c229885-d kernel: EXT2-fs error (device ide2(33,6)):
ext2_free_blocks: Freeing blocks not in datazone - block = 1701996576,
count = 1
Mar 22 22:35:54 c229885-d kernel: EXT2-fs error (device ide2(33,6)):
ext2_free_blocks: Freeing blocks not in datazone - block = 1747074406,
count = 1
Mar 22 22:35:54 c229885-d kernel: EXT2-fs error (device ide2(33,6)):
ext2_free_blocks: Freeing blocks not in datazone - block = 980448372,
count = 1
Mar 22 22:35:54 c229885-d kernel: EXT2-fs error (device ide2(33,6)):
ext2_free_blocks: Freeing blocks not in datazone - block = 1634742063,
count = 1
Mar 22 22:35:54 c229885-d kernel: EXT2-fs error (device ide2(33,6)):
ext2_free_blocks: Freeing blocks not in datazone - block = 779314535,
count = 1
<snipped a bunch of the same messages>
Mar 23 00:14:18 c229885-d kernel: fs error (device ide2(33,6)):
ext2_free_blocks: Freeing blocks not in datazone - block = 543716207,
count = 1
Mar 23 00:14:18 c229885-d kernel: EXT2-fs error (device ide2(33,6)):
ext2_free_blocks: Freeing blocks not in datazone - block = 792478540,
count = 1
Mar 23 00:14:18 c229885-d kernel: EXT2-fs error (device ide2(33,6)):
ext2_free_blocks: Freeing blocks not in datazone - block = 792477249,
count = 1
Mar 23 00:14:18 c229885-d kernel: EXT2-fs error (device ide2(33,6)):
ext2_free_blocks: Freeing blocks not in datazone - block = 1414418246,
count = 1
Mar 23 00:14:18 c229885-d kernel: EXT2-fs error (device ide2(33,6)):
ext2_free_blocks: Freeing blocks not in datazone - block = 1094453822,
count = 1
Mar 23 00:14:18 c229885-d kernel: EXT2-fs error (device ide2(33,6)):
ext2_free_blocks: Freeing blocks not in datazone - block = 1701996576,
count = 1
Mar 23 00:14:18 c229885-d kernel: EXT2-fs error (device ide2(33,6)):
ext2_free_blocks: Freeing blocks not in datazone - block = 1747074406,
count = 1
<snipped again...>
ar 23 04:02:00 c229885-d anacron[5792]: Updated timestamp for job
`cron.daily' to 2001-03-23
Mar 23 04:06:42 c229885-d PAM_pwdb[5917]: (su) session opened for user
news by (uid=0)
Mar 23 04:06:43 c229885-d PAM_pwdb[5917]: (su) session closed for user
news
Mar 23 09:06:19 c229885-d PAM_pwdb[5099]: check pass; user unknown
Mar 23 09:06:50 c229885-d last message repeated 9 times
Mar 23 09:07:02 c229885-d PAM_pwdb[804]: check pass; user unknown
Mar 23 09:07:03 c229885-d login[804]: FAILED LOGIN 1 FROM (null) FOR
daniel, User not known to the underlying authentication module
Mar 23 09:07:08 c229885-d PAM_pwdb[804]: check pass; user unknown
Mar 23 09:07:09 c229885-d login[804]: FAILED LOGIN 2 FROM (null) FOR
root, Authentication failure
Mar 23 09:07:22 c229885-d PAM_pwdb[804]: check pass; user unknown
Mar 23 09:07:24 c229885-d login[804]: FAILED LOGIN 3 FROM (null) FOR
laura, User not known to the underlying authentication module
Mar 23 09:07:28 c229885-d PAM_pwdb[804]: check pass; user unknown
Mar 23 09:07:29 c229885-d login[804]: FAILED LOGIN SESSION FROM (null)
FOR root, Authentication failure
Mar 23 09:08:12 c229885-d PAM_pwdb[6884]: check pass; user unknown
Mar 23 09:08:14 c229885-d login[6884]: FAILED LOGIN 1 FROM (null) FOR
daniel, User not known to the underlying authentication module
Mar 23 09:09:57 c229885-d PAM_pwdb[5099]: check pass; user unknown
Mar 23 09:12:18 c229885-d last message repeated 2 times
Mar 23 09:12:29 c229885-d last message repeated 3 times