любое действие, коее вызывает gksu (синаптик гдеби апдате-манагер и тп)
shost - это я
Jun 7 08:50:41 localhost su[32293]: pam_unix(su:auth): authentication failure; logname= uid=1000 euid=0 tty=/dev/pts/0 ruser=shost rhost= user=root
Jun 7 08:50:41 localhost su[32293]: pam_winbind(su:auth): getting password (0x00000388)
Jun 7 08:50:41 localhost su[32293]: pam_winbind(su:auth): pam_get_item returned a password
Jun 7 08:50:41 localhost su[32293]: pam_winbind(su:auth): request wbcLogonUser failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_USER_UNKNOWN (10), NTSTATUS: NT_STATUS_NO_SUCH_USER, Error message was: No such user
Jun 7 08:50:43 localhost su[32293]: pam_authenticate: Authentication failure
Jun 7 08:50:43 localhost su[32293]: FAILED su for root by shost
Jun 7 08:50:43 localhost su[32293]: - /dev/pts/0 shost:root