UNIX Account getting Locked Everyday between same Time Frame

UNIX for Beginners Q & A UNIX for Dummies Questions & Answers
1

I am facing an Issue with a particular Unix Account ( ie a particular Userid) getting LOCKED everyday between 7:30am and 8:00am. The Password associated with this particular Account has been setup such that it should never Expire at all but it does LOCK the Account after more than 3 failed attempts.This is an AIX 5.3 Server.

I am not a Unix Admin but just an Application User.I am NOT aware of any jobs running on this Server during this time or running on other Servers trying to Connect to this Particular Server under this Unix Account.

Everyday i test this Account by loggin in at 7:30am and then 8:00am .At 7:30am it works fine but by 8:00am it gets locked.So somewhere in between it gets Locked. This has been happening since more than a Week and everyday i have to request my Security team to unlock the Account after 8:00am.Not exactly sure when this issue started.

In this Scenario , given the timeframe 7:30am and 8:00am between which the LOCK occurs, how do i go about Figuring out why this Account on this server is getting Locked? Will the Unix Admin be in a position to determine what is happening during this timeframe causing this LOCK?

2

I am not AIX fluent at all, but IBM always has something comparable to what other UNIX flavors have. Generally, there is always a system log and an su log (su usage) as well. Your sysadmin can look in those files to find the user (a user who tries to login and fails is the most likely candidate) that is locking the account with login failures. When an account is locked because of login fails, a message is usually written to a log.

The AIX guys can tell you exactly, but if your sysadmin does not know where to look (or if logfails monitoring is turned off) you have worse problems than a locked out account.

3

It looks like Your sysadmin needs to check the cron jobs running in between 7:30AM to 8:00AM. I think one of those cron jobs is the culprit.

4

Perhaps you can check yourself.

grep -w userid /var/adm/messages

or /var/log/authlog .
As the user run

crontab -l
5

Thak you all for the responses above .I checked the file

/var/adm/authlog

on the server i am experiencing the LOCK issue .The server is xaayaas6.

Aug 9 07:45:00 xaayaas6 auth|security:info sshd[2928858]: Authentication refused: bad ownership or modes for file /home/test
Aug 9 07:45:00 xaayaas6 auth|security:info sshd[2719876]: Authentication refused: bad ownership or modes for file /home/test
Aug 9 07:45:00 xaayaas6 auth|security:info sshd[2719876]: Authentication refused: bad ownership or modes for file /home/test
Aug 9 07:45:00 xaayaas6 auth|security:info sshd[2928858]: Authentication refused: bad ownership or modes for file /home/test
Aug 9 07:45:00 xaayaas6 auth|security:info sshd[2928858]: Failed password for test from 176.67.780.234 port 33584 ssh2
Aug 9 07:45:00 xaayaas6 auth|security:info sshd[2719876]: Failed password for test from 176.67.780.234 port 33585 ssh2
Aug 9 07:45:00 xaayaas6 auth|security:info syslog: ssh: failed login attempt for test from 176.67.780.234

In the above Messages , test is the User Account which is getting LOCKED daily on the server xaayaas6. So what does the above messages mean? Any job trying to access the xaayaas6 from Server associated with IP : 176.67.780.234 (this is a valid server that i am aware of) ? How do i find this Job on the server asscoiated with IP : 176.67.780.234 ?

6

The authlog sais the homedir permission is wrong; pls check with

ls -ld /home/test

Then, log in as test

ssh test@176.67.780.234

And there check

crontab -l

for anything at 7:45