I was doing some maintenance on my web server (via root account over ssh) after several months of disuse. I shut it down yesterday and today, after startup I can't log in to root account at tty or via ssh. Only thing standing out in my mind is the root account was logged in at the system and I shut down remotely.
I found a link here suggested a fix to reset the root password from rescue mode. I followed the advise to bind the /dev directory with LVM before chroot and changed the password and restarted,
Root will still not login.
The only log file to show any real sign of the problem was /var/log/secure
. Right at the top you can see the attempt to connect via SSH and then at the term tty1.
// UPDATE
I've updated the errors from /var/log/secure
to just reflect the suggestions:
First attempt to login with root today:
Jul 26 09:38:49 mrwizard login: pam_unix(login:session): session opened for user root by LOGIN(uid=0)
Jul 26 09:38:49 mrwizard login: ROOT LOGIN ON tty1
Jul 26 09:38:50 mrwizard login: pam_unix(login:session): session closed for user root
Trying su - and sudo su -
Jul 26 09:58:33 mrwizard su: pam_unix(su-l:session): session opened for user root by xtian(uid=0)
Jul 26 09:58:33 mrwizard su: pam_unix(su-l:session): session closed for user root
Jul 26 09:58:41 mrwizard su: pam_unix(su-l:auth): authentication failure; logname=xtian uid=500 euid=0 tty=tty1 ruser=xtian rhost= user=root
Jul 26 09:58:51 mrwizard su: pam_unix(su-l:session): session opened for user root by xtian(uid=500)
Jul 26 09:58:51 mrwizard su: pam_unix(su-l:session): session closed for user root
Jul 26 09:58:58 mrwizard sudo: xtian : TTY=tty1 ; PWD=/etc ; USER=root ; COMMAND=/bin/su -
Jul 26 09:58:58 mrwizard su: pam_unix(su-l:session): session opened for user root by xtian(uid=0)
Jul 26 09:58:58 mrwizard su: pam_unix(su-l:session): session closed for user root
Changing password for root:
Jul 26 09:59:22 mrwizard sudo: xtian : TTY=tty1 ; PWD=/etc ; USER=root ; COMMAND=/usr/bin/passwd
Jul 26 09:59:32 mrwizard passwd: pam_unix(passwd:chauthtok): password changed for root
Jul 26 09:59:32 mrwizard passwd: gkr-pam: couldn't update the 'login' keyring password: no old password was entered
$ authconfig --test
works
Jul 26 12:38:04 mrwizard userhelper[31089]: running '/usr/share/authconfig/authconfig.py --test' with root privileges on behalf of 'xtian'
// END UPDATE
Where else can I look? Did I bork the root access shutting it down remotely while still logged in at the box?