sequences in the auth.log

From: Sandor Berta (berta_at_beco.hu)
Date: 08/13/04

  • Next message: Dan Langille: "Re: sequences in the auth.log" 
    Date: Fri, 13 Aug 2004 16:05:34 +0200
To: freebsd-security@freebsd.org

    Hi all,
    I found similar sequences in the
    /var/auth.log files of freebsd boxes, I supervise.:
    Aug 13 13:56:08 www sshd[26091]: Illegal user test from 165.21.103.20
    Aug 13 13:56:11 www sshd[26093]: Illegal user guest from 165.21.103.20
    Aug 13 13:56:15 www sshd[26096]: Illegal user admin from 165.21.103.20
    Aug 13 13:56:18 www sshd[26103]: Illegal user admin from 165.21.103.20
    Aug 13 13:56:21 www sshd[26105]: Illegal user user from 165.21.103.20
    Aug 13 13:56:25 www sshd[26107]: Failed password for root from
    165.21.103.20 port 39678 ssh2
    Aug 13 13:56:28 www sshd[26109]: Failed password for root from
    165.21.103.20 port 39760 ssh2
    Aug 13 13:56:32 www sshd[26111]: Failed password for root from
    165.21.103.20 port 39836 ssh2
    Aug 13 13:56:35 www sshd[26113]: Illegal user test from 165.21.103.20
    Aug 13 14:25:36 www sshd[26485]: Illegal user test from 202.28.120.57
    Aug 13 14:25:41 www sshd[26487]: Illegal user guest from 202.28.120.57

    What are these?

    bye
    Sandor Berta

    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"

  • Next message: Dan Langille: "Re: sequences in the auth.log"

    Relevant Pages

    • Sind das Angriffe?
      ... Jan 16 06:44:22 micky sshd: Failed password for proxy from 38.97.212.172 port 52993 ssh2 ...
      (de.comp.security.firewall)
    • Attempt to breakin
      ... port 42989 ssh2 ... Jul 6 21:37:53 findmoore sshd: Failed password for root from ...
      (comp.os.linux.networking)
    • Grafting a SSH auto-drop chain onto Arnos 1.8.3-RC1
      ... Mar 21 13:16:06 gateway sshd: Failed password for illegal user ... anonymous from 213.64.252.243 port 59768 ssh2 ...
      (comp.os.linux.security)
    • Enforce SSH Login Delay
      ... ::ffff:211.171.191.106 port 11328 ssh2 ... Dec 10 13:18:28 turf sshd: Failed password for root from ...
      (comp.os.linux.misc)
    • bruteforce not restarting pf?
      ... port 56265 ssh2 ... Nov 7 07:06:58 zeus sshd: Failed password for illegal user miha from ...
      (freebsd-questions)