2

I am using Logwatch on my server, whcih is running Ubuntu 10.0.4

I saw the following line in the LogWatch report:

Unmatched Entries pam_env(sshd:setcred): Unable to open env file: /etc/default/locale: No such file or directory : 9 time(s)

Can anyone explain what the line means - and should I be worried?

If a course of action or further investigation is required, can anyone please reocmmend a course of action or how to investigate this issue further?

1 Answer 1

2

The message comes from pam, which is the subsystem for user authentication and related tasks. Specifically, it comes from the ssh server calling the pam library to authenticate users. It is driven in this by the configuration file /etc/pam.d/sshd.

/etc/default/locale is a file that exists on a default Debian or Ubuntu installation. It is supposed to contain definitions of locale environment variables — default preferences for the interface language, the character set, the date format, etc.

On a default Ubuntu installation, /etc/pam.d/sshd contains the line
    auth required pam_env.so envfile=/etc/default/locale
so that users get the locale settings in their environment when they log in over ssh.

The file doesn't exist on your system. That's unexpected, but harmless from a security point of view.

1
  • Or perhaps the file is unreadable due to a permission problem? Aug 21, 2010 at 17:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .