Red Hat

I tried to run the command but it give me an error command not found.

---------- Post updated at 11:44 AM ---------- Previous update was at 11:32 AM ----------

getenforce command gave me Permissive as output.

put sealert gave me an error "command not found"

If SELinux is enabled and in enforcing mode, you need to install additional package for using sealert, which is setroubleshoot-server. Since you are in single user mode, you would not be able to take advantage of yum and you will need to install the rpm manually resolving the numerous dependencies.

An alternate way would be to just browsing through the audit.log file with something like this:

Code:

grep -Ei "fail|pam|denied" /var/log/audit/audit.log | more

I'm sure this is not a production server. Correct? How about reinstalling the OS? Without having access to the server, resolving this kind of issue is kind of tough. Let us see what other more experienced Linux admins have to say about this issue.

I also checked the /var/log/audit folder its empty.

Just saw your update. If SELinux is in permissive mode, then the issue should not be caused by SELinux AVC denials.

I also checked the /var/log/audit folder its empty. Is this an issue?

/var/log/audit/ directory could be empty when auditing subsystem is disabled. This is not an issue.

Anyway, if possible could you uninstall and reinstall PAM related packages?

1. check what all PAM related packages are installed:

Code:

rpm -qa | grep pam

2. erase the packages:

Code:

rpm -ev pam-xyz.rpm

3. reinstall PAM:

Code:

rpm -ivh pam-xyz.rpm

Lets hope for the best!!

Will reinstalling pam related packages affect the usernames and passwords existing on the machine?