RE: Sudden trouble logging in to my ISP


Subject: RE: Sudden trouble logging in to my ISP
From: Timothy W. Gibson (gibsont@alaska.net)
Date: Sun Sep 08 2002 - 19:56:11 AKDT


I've had the same problem:

I'm running Suse 7.3 on a celeron 433 with 98megs and lots o' drive
space. My modem is a USR 56k external. Running KDE 3.0.

Kppp started off by giving me problems. It will only make a full
connection to my ISP about 25% of the time. It will dial and appears
to authenticate, but for some reason the connection will usually not
work- I can ping my ISP's server, I get an IP address, but that's it.
I can't resolve host names, and even if I know the IP address of the
site I want to connect to, it will just time out. Looking at the
connection stats, I see a few packets exchanged right at sign on, and
then flat line after that.

So, I started using wvdial to make my connections, and it worked fine
for several months. But now, it's gone south on me. The error message
it gives before it shuts the terminal window goes by so fast I don't
have time to read it all, but it says something about "sending password
and hoping for the best..."

This just happened within the last couple of days. I will check my log
files and see what they say. Isent this problem to the Suse list already
and not gotten too much back yet...

Thanks!
Tim

-----Original Message-----
From: aklug-bounce@aklug.org [mailto:aklug-bounce@aklug.org]On Behalf Of
James David Bruchie
Sent: Saturday, September 07, 2002 7:53 PM
To: aklug@aklug.org
Subject: Sudden trouble logging in to my ISP

I've been running Linux on my home machine for several years now.
I've been using Internet Alaska as my ISP for about as long. Sometime
between 13:00 and 17:45 last Thursday something changed, and I could no
longer log in to my ISP account. Shortly after my login script sent the
password, the send/recieve lights on the modem would start flickering
and would stay that way, I never got my IP addresses. If I waited long
enough I got a message somethig like "invalid login id".

I called tech support and they changed my password, but could not fix
my problem. Eventually I enabled pppd debug messages, and noticed the
server was sending <auth pap> in the LCP messages, and my system was
rejecting it. I tried setting up a pap-secrets file with my ISP user ID
and password, that got me logged on. In looking at the debug output my
system is sending my ID and password a second time embedded in the LCP
messages.

I had a laptop with a windows 2000 partition left on it. I set it up to
dial in with its internal modem, it worked fine. Tech support tried
logging in with a MAC on a serial line with my ID, it worked fine.

Has anyone else noticed this happening?

In looking for the problem I noticed things going on with my logs:

/var/adm/messages started thursday morning (sept 5) at 4:40
with several lines of "syslogs 1.4.1: restart"
A new file, /var/adm/messages.1, stopped at 4:22:08
This was apparantly my original messages file.
I noticed several other files with .1 suffixes
I reloaded my system (I was upgrading anyway) from cdroms.

If I got hacked, I certainly left the door open. I was in the middle of
loading slackware 8.1 on new hardware (athlon 2200+). I had not yet
cleaned up inetd.conf and friends, then decided to down load the new
slackware 9.0 beta over night. Not my most brilliant move.

I'm not sure how this could have affected how I log in to my ISP, unless
it some how wiped out an existing pap-secrets file I did not realize I
had. However I do not remember ever creating a pap-secrets file before,
and I've been at this for several years and half a dozen system upgrades.

Dave Bruchie

---------
To unsubscribe, send email to <aklug-request@aklug.org>
with 'unsubscribe' in the message body.

---------
To unsubscribe, send email to <aklug-request@aklug.org>
with 'unsubscribe' in the message body.



This archive was generated by hypermail 2a23 : Sun Sep 08 2002 - 19:58:01 AKDT