From owner-freebsd-questions@FreeBSD.ORG  Tue Aug 17 15:17:47 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 9ED7216A4DD
	for <freebsd-questions@freebsd.org>;
	Tue, 17 Aug 2004 15:17:47 +0000 (GMT)
Received: from mail2.speakeasy.net (mail2.speakeasy.net [216.254.0.202])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 360CF43D4C
	for <freebsd-questions@freebsd.org>;
	Tue, 17 Aug 2004 15:17:47 +0000 (GMT)
	(envelope-from freebsd-questions-local@be-well.ilk.org)
Received: (qmail 2411 invoked from network); 17 Aug 2004 15:17:46 -0000
Received: from dsl092-078-145.bos1.dsl.speakeasy.net (HELO be-well.no-ip.com)
	([66.92.78.145])
	(envelope-sender <freebsd-questions-local@be-well.ilk.org>)
	by mail2.speakeasy.net (qmail-ldap-1.03) with SMTP
	for <freebsd-questions@freebsd.org>; 17 Aug 2004 15:17:46 -0000
Received: by be-well.no-ip.com (Postfix, from userid 1147)
	id 6A53C7D; Tue, 17 Aug 2004 11:17:46 -0400 (EDT)
Sender: lowell@be-well.ilk.org
To: Mark <boxend@redtick.homeunix.com>
References: <200408171508.i7HF832Z018959@redtick.homeunix.com>
From: Lowell Gilbert <freebsd-questions-local@be-well.ilk.org>
Date: 17 Aug 2004 11:17:46 -0400
In-Reply-To: <200408171508.i7HF832Z018959@redtick.homeunix.com>
Message-ID: <448ycdhjz9.fsf@be-well.ilk.org>
Lines: 17
User-Agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.3
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
cc: freebsd-questions@freebsd.org
Subject: Re: logins
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 17 Aug 2004 15:17:47 -0000

Mark <boxend@redtick.homeunix.com> writes:

> I've beend getting the sshd login attempts, like everyone else so I've been 
> watching the logs close, this is the first time to see this item in /var/log/messages. 
> Aug 14 04:15:00 chillico su: _secure_path: /nonexistent/.login_conf is not owned by uid 65534

The machine doesn't have a '/nonexistent/' directory, does it?  
It is important security-wise that such a directory must *not* exist.

> I've looked in the passwd file and groups, there is not a uid of 65534 listed.

There *should* be; it's "nobody".  And it shouldn't be in the wheel group.

> I installed rsync last week to backup some windows computers during the weekend, this would have been
> during one of the backups, but the other five would have triggered the same msg, just thinking outloud here.

Unless /nonexistent got created during the process...