logins

[Lowell Gilbert]

Mark <boxend at redtick.homeunix.com> writes:

> I've beend getting the sshd login attempts, like everyone else so I've been 
> watching the logs close, this is the first time to see this item in /var/log/messages. 
> Aug 14 04:15:00 chillico su: _secure_path: /nonexistent/.login_conf is not owned by uid 65534

The machine doesn't have a '/nonexistent/' directory, does it?  
It is important security-wise that such a directory must *not* exist.

> I've looked in the passwd file and groups, there is not a uid of 65534 listed.

There *should* be; it's "nobody".  And it shouldn't be in the wheel group.

> I installed rsync last week to backup some windows computers during the weekend, this would have been
> during one of the backups, but the other five would have triggered the same msg, just thinking outloud here.

Unless /nonexistent got created during the process...