When I woke up this morning and checked the logs, I found that I've been getting :
Jan 11 07:55:32 io gdm-binary[3071]: Couldn't authenticate user Jan 11 07:55:32 io gdm(pam_unix)[3071]: bad username []
Once a second, ever second, since early yesterday. Logwatch says there were 36945 of these entries, and it has been continuing this morning. I've checked gdm.conf. It will not accept remote connections. I restricted it a bit further. The firewall was already configured to deny all external connections except to port 80 from one specific IP. I tried killing the gdm processes. They simply re-spawn.
Finally, I rebooted. This stopped the errors. Does anyone have any idea what was happening? Was it an attack, or a gdm bug?
Regards, Randy
