PAM_USER_UNKNOWN

[JohnFLi]

Hello, I recently started getting the following 'alerts'

Code:

New alerts:
* 1 SSH login failures:
Aug 11 06:41:52 G1PPFreeNas01 1 2023-08-11T06:41:52.764847-07:00 machinename.domainname.local sshd 36649 - - pam_winbind(sshd): request wbcLogonUser failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_USER_UNKNOWN (13), NTSTATUS: NT_STATUS_NO_SUCH_USER, Error message was: The specified account does not exist.

ANyway to find out what user is trying to sign in, or at least the ip?

 

[albrecd]

You may be able to find more information in /var/log/auth.log.

Does this server have SSH exposed external to your network or are you attempting to identify internal activity? If external you may want to implement an access control list at your network firewall (block SSH from all external by default, then allow a few expected IPs or subnets).

 

[JohnFLi]

You may be able to find more information in /var/log/auth.log.

Does this server have SSH exposed external to your network or are you attempting to identify internal activity? If external you may want to implement an access control list at your network firewall (block SSH from all external by default, then allow a few expected IPs or subnets).

sorry for the delay...
this is only accessable locally.

I looked at the log file (thank you) at that time, and (this is odd)
it says

pam_winbind(sshd): user 'root' not found Accepted password for root from <ip of my workstation> port 61624 ssh2 pam_winbind(sshd): PAM_ESTABLISH_CRED not implemented pam_winbind(sshd): PAM_REINITIALIZE_CRED not implemented <3 min. later> pam_winbind(sshd): user 'root' OK

 

[albrecd]

I found a topic mentioning similar behavior that may be relevant - it seems like in this case it was due to AD services: Topic 96246.

If your server is domain joined this might explain the logs.

 

[JohnFLi]

I found a topic mentioning similar behavior that may be relevant - it seems like in this case it was due to AD services: Topic 96246.

If your server is domain joined this might explain the logs.

Thank you...i did see that, but wasn't sure if my issue is the same.... even if is....I don't think i would want to risk modifying said file. I have issues with rebooting as it is. WHenever i tell it to reboot.....it hangs partway through the startup process....then i have to power off the machine...power on, then it comes up as normal....but takes about 10 to 15 min. to come up.

 

[albrecd]

Yeah I definitely wouldn't be in a hurry to modify the PAM config, but it may be worth disabling verbose logging on the AD side (even temporarily) to validate whether that is the source.

 

[JohnFLi]

Yeah I definitely wouldn't be in a hurry to modify the PAM config, but it may be worth disabling verbose logging on the AD side (even temporarily) to validate whether that is the source.

True....now to find where in the heck that is. lol (been one heck of a month)