Logcheck & "lame server resolving 'pam_deny.so'"

[cibonato]

Ladies and gentlemen, since some time I'm having a quite strange problem related to BIND and Logcheck (I guess). It turns out that at every hour I get messages like these in /var/log/syslog:

Mar 10 23:02:06 mordred named[2726]: lame server resolving 'pam_deny.so' (in 'so'?): 38.97.212.53#53
Mar 10 23:02:06 mordred named[2726]: lame server resolving 'pam_deny.so' (in 'so'?): 205.166.226.38#53

mordred is the DNS/mail server and everything is running fine, but these strange messages. Checking the log I could find that the line appearing immediately these ones is a line concerning Postfix. Actually, it is the one whose informs about the message Logcheck sends me every hour. It seems like the system is looking for user (maybe mine) and do a DNS check for a domain "pam_deny.so". Is that possible?

I see other messages related to lame server in the same log, but they occurs with real domains. What is bothering me is the fact that it is trying to resolve the pam_deny.so domain.

Just to clarify things a little bit, I have no problems at all regarding authentication.

Any hints?

Thank you!!!
_________________
64 Bits, good good!

[jmbsvicetto]

Hi.

pam_deny.so is one of the pam modules. Have you tried looking your pam config files in /etc/pam.d/ for some error? If you think it's related to postfix, have you tried looking at the /etc/pam.d/smtp? Are you using SASL with postfix? If so, are you using SASLAUTHD?
_________________
Jorge.

Your twisted, but hopefully friendly daemon.
AMD64 / x86 / Sparc Gentoo
Help answer || emwrap.sh

[cibonato]

I've looked the config files at /etc/pam.d/ and I don't think they have problems. Well, I've never touched them and could not say precisely what should go in each one. There is just one file talking about the pam_deny.so module, it is /etc/pam.d/other and it seems to be that this file is used by a service if the service does not have a proper one. The system do have no /etc/pam.d/smtp config file. And yes, it does use SASL with Postfix and the system does have a the SASLAUTHD daemon running.

What is strange is, and maybe in 99% of all problems every one says the same, the problem started some days ago and the system had being running fine for almost 6 months (and SASL authentication is available since then).

Cheers.
_________________
64 Bits, good good!