Panther killing me

H

herrmag

Registered
I have a G5 running OS X 10.3.6

I can't log in using any account. When I type in my username and pass, it sends me to a command prompt asking for yep, you guessed it, my username and pass. When I enter them again, it gives me this error for a split second before going back to the GUI login screen:

"Login: could not set audit mask"


I've gone into single user mode, run fsck -f and all is good.....Except I still can't log in....I've tried utilizing the disk utilities on the installation CD. I removed the security features concerning open firmware so that I could boot to CD, but the system hangs when I try to do that (I've tried both holding down C at bootup as well as holding down option and choosing the CD icon). When I do either, the system then goes to the grey screen, but instead of an apple in the middle of the screen, there's a circle with a line through it, and the system just hangs :(

I followed many of the suggestions in the "common criteria" booklet, to include disabling the root account (I'm wondering if this might be an issue). If anyone can assist me, I'd greatly appreciate it!
 
Oh, forgot to mention what i found in the syslog. These two errors are critical. I only wish I knew how to fix them.

loginwindow [361]: Error getting user's auditevent mask
loginwindow [361]: Failed setting audits session information
 
What program were you using that destroyed your system settings? What update did you install? What caused this to happen?


You can go to Apple and do a Search for 'audit'. In particular, you may want to start on Page 61, although there is good information about auditing both before and after Page 61.
 
If you are able to login a the UNIX prompt as root or something, which it sounds like you can, then authentication looks as you can run fsck, and so it would look like a problem with the GUI login and/or persmissions.

Looks as though the disk is ok as fsck has worked?

I'm concerned that you can't boot from the CD as you can do a repair permissions on the boot disk.

Is the CD/DVD player on the same interface as the boot disk. Not knowing what G5 you have, iMac or Standalone (I don't have either), but its possible that if the boot disk is on the same buss as the CD and the boot disk has been jumpered to be the master on the ATA bus, then htis could prevent the CD/DVD from booting.
 
Thanks guys for your responses, but I've fixed it. The main issue was BSM auditing. I'm not sure exactly what was wrong with my /etc/security/audit_control file, but I must've set a flag that the system didn't like.

I went into single-user and simply changed the audit_control file. I had tried doing that previously, but the system would not allow me to change a "read-only" file. I had to mount the root file system ("/sbin/mount /"), and then my super user privileges became evident. I'm not sure whether that is something native to MAC OS X/BSD, or whether my settings were a little weird, but I know I've always had superuser privilege as soon as I go into single-user mode on my Linux and Irix boxes. I'm new to Mac's, so I guess this is a lesson learned :)
 
Hi Herrmag, do you mind enlightening me how did you fix this issue? I have the same problem as well, I accidentally remove the audit_user file to trash bin, and has the same error message "could not set audit mask" after keying in my ID and password. Please can you teach me how to restore the file?

Many thanks in advance!!!
 
The user Herrmag has not returned here in more than 10 years!

@Lee Juen: Are you running Panther (OS X 10.3.9)?
Best fix will likely be to boot to the OS X installer CD, and reinstall Panther, choosing the option to Archive & Install.
If, instead, your Mac is running a system considerably newer than Panther (current from 2003 to 2005), then you would just boot to the installer, and reinstall. The install will simply replace the components that the system needs to boot properly, which is what you need, eh?
 
You must log in or register to reply here.
Back
Top