Can't login: no pam_unix.so found

[Victor Star]

Hi Mel,

>> pam_unix.so is in /usr/lib:
>> ====- 8< -===================================================
>> # ls -l /usr/lib/pam_unix*
>> lrwxr-xr-x  1 root  wheel     13 Sep 25  2006 /usr/lib/pam_unix.so ->
>> pam_unix.so.3 -r--r--r--  1 root  wheel  10240 Feb 19  2007
>> /usr/lib/pam_unix.so.3 # file /usr/lib/pam_unix.so
>> /usr/lib/pam_unix.so: symbolic link to `pam_unix.so.3'
>> ====- 8< -===================================================

> If ldd /usr/lib/pam_unix.so does not show undefined libs, then first thing I'd 
> look would be towards limits, most notably open file limits:
> compare sysctl kern.openfiles with output of limits -Hn.

Yes, ldd shows no undefined libs. Here is the output for the file limits:
==- 8< -========================================================================
# sysctl kern.openfiles
kern.openfiles: 332
# limits -Hn
Resource limits (current):
  openfiles            1735

==- 8< -========================================================================

>> -===================================================
>> Sep 18 11:11:37 xxxxxx su: BAD SU <myloginname> to root on /dev/ttyp3

> Did or did you not mistype password?

I can't completely deny I didn't. I could have. But I somewhat doubt it.
There were some glitches with the router NAT around that time, for whatever reason it stopped
forwarding POP traffic to the appropriate port, I was trying to fix it.
There is a slight chance POP traffic was forwarded to SSH. That would explain the following lines,
but POP trying to go SU looks somewhat unusual.

>> Sep 18 11:13:46 xxxxxx sshd[45047]: Bad protocol version identification
>> '\377\364\377\375\006quit' from <some ip here> Sep 18 11:15:08 xxxxxx
>> sshd[45056]: Received disconnect from <some ip here>: 2: Bad packet length
>> 710099706. ====- 8< -===================================================

> That's some user doing telnet on port 22 and doesn't know how to talk ssh.


-- 
Best regards,
 Victor