PAM_pwdb: check pass; user unknown

[vod]

Hi,

lately i have seen numerous such entry in /var/log/messages.

Jan 19 01:32:58 unix1 proftpd[3619]: xx.xx.xx.xx (userIP [userIP]) - FTP session opened. Jan 19 01:32:58 unix1 PAM_pwdb[3619]: check pass; user unknown Jan 19 01:32:59 unix1 proftpd[3619]: xx.xx.xx.xx (userIP[userIP]) - PAM([email protected]): User not known to the underlying authentication module

Any idea what is wrong?

thanks

 

[duke28]

i have the same problem and outlook is very long to connect and disconnect since 12 hours..

around 1 minuts or 2

and my messages ar full of this :

Sep 30 20:45:36 box3 PAM_pwdb[3297]: check pass; user unknown
Sep 30 20:45:36 box3 PAM_pwdb[8434]: check pass; user unknown
Sep 30 20:45:37 box3 PAM_pwdb[8887]: check pass; user unknown
Sep 30 20:45:38 box3 PAM_pwdb[29553]: check pass; user unknown
Sep 30 20:45:38 box3 PAM_pwdb[8694]: check pass; user unknown
Sep 30 20:45:38 box3 PAM_pwdb[20620]: check pass; user unknown
Sep 30 20:45:38 box3 PAM_pwdb[16201]: check pass; user unknown
Sep 30 20:45:39 box3 PAM_pwdb[31656]: check pass; user unknown
Sep 30 20:45:40 box3 PAM_pwdb[26142]: check pass; user unknown
Sep 30 20:45:40 box3 PAM_pwdb[20045]: check pass; user unknown
Sep 30 20:45:40 box3 PAM_pwdb[2457]: check pass; user unknown
Sep 30 20:45:42 box3 PAM_pwdb[21469]: check pass; user unknown
Sep 30 20:45:42 box3 PAM_pwdb[15896]: check pass; user unknown
Sep 30 20:45:43 box3 PAM_pwdb[4085]: check pass; user unknown
Sep 30 20:45:43 box3 PAM_pwdb[1472]: check pass; user unknown
Sep 30 20:45:44 box3 PAM_pwdb[24052]: check pass; user unknown
Sep 30 20:45:45 box3 PAM_pwdb[8437]: check pass; user unknown
Sep 30 20:45:45 box3 PAM_pwdb[10143]: check pass; user unknown


so why?

 

[nhouse]

Hi There... did you find a solution to this issue? I am having similar issues.

 

[AndyII]

raising an old thread..
my nephew was asking me about this sort of thing, says logs are full of this
seems no IP associated with it so where does it originate from?, and how to stop or avoid,
also trying others like:
authentication failure; (uid=0) -> root for vm-pop3d service
PAM_pwdb[32767]: authentication failure; (uid=0) -> mailnull for vm-pop3d service
PAM_pwdb[330]: authentication failure; (uid=0) -> nfsnobody for vm-pop3d service
PAM_pwdb[343]: authentication failure; (uid=0) -> rpcuser for vm-pop3d service

any advice is appreciated.