Re: sequences in the auth.log

From: Dan Langille (dan_at_langille.org)
Date: 08/13/04

  • Next message: Nikolaj I. Potanin: "Re: sequences in the auth.log" 
    Date: Fri, 13 Aug 2004 10:11:18 -0400 (EDT)
To: Sandor Berta <berta@beco.hu>

    On Fri, 13 Aug 2004, Sandor Berta wrote:

    > Hi all,
    > I found similar sequences in the
    > /var/auth.log files of freebsd boxes, I supervise.:
    > Aug 13 13:56:08 www sshd[26091]: Illegal user test from 165.21.103.20
    > Aug 13 13:56:11 www sshd[26093]: Illegal user guest from 165.21.103.20
    > Aug 13 13:56:15 www sshd[26096]: Illegal user admin from 165.21.103.20
    > Aug 13 13:56:18 www sshd[26103]: Illegal user admin from 165.21.103.20
    > Aug 13 13:56:21 www sshd[26105]: Illegal user user from 165.21.103.20
    > Aug 13 13:56:25 www sshd[26107]: Failed password for root from
    > 165.21.103.20 port 39678 ssh2
    > Aug 13 13:56:28 www sshd[26109]: Failed password for root from
    > 165.21.103.20 port 39760 ssh2
    > Aug 13 13:56:32 www sshd[26111]: Failed password for root from
    > 165.21.103.20 port 39836 ssh2
    > Aug 13 13:56:35 www sshd[26113]: Illegal user test from 165.21.103.20
    > Aug 13 14:25:36 www sshd[26485]: Illegal user test from 202.28.120.57
    > Aug 13 14:25:41 www sshd[26487]: Illegal user guest from 202.28.120.57

    There are failed attempts to login via ssh. 

    -- 
Dan Langille - http://www.langille.org/
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
  • Next message: Nikolaj I. Potanin: "Re: sequences in the auth.log"

    Relevant Pages

    • Re: SSH login automation, get stuck at the last step.
      ... The ssh server that I am copying the public key to is not a typical ... The user "root" to login this box can not access the ... puts stderr "EXP username requested and sent " ...
      (comp.lang.tcl)
    • SUMMARY: how to set correct path?
      ... ven if we login with ssh. ... For BASH login shell, place the system wide ENV variables, such as PATH, ... You can set Use_login in the sshd_config to yes and restart sshd. ...
      (SunManagers)
    • Re: ssh brute force attacks
      ... What you are most likely seeing are SSH worms on hacked PCs that scan ... -- use a separate username/password for SSH access, ... -- enforce more complex usernames & passwords for all users on the server ... Instead require the user to login as a non-root user first, ...
      (comp.os.linux.misc)
    • Re: Authentication with SSH using public keys
      ... I use ssh to login remotely. ... there looks odd, or different, from other remote hosts I do this on. ... The permissions on the machine where it doesn't work: ...
      (freebsd-questions)
    • Public Authentication Problem on Batch Job using SCP2 when SSH Client Reboot
      ... to a SSH server, HOST2. ... for secure ftp login. ... The login ID is a local user account ... we found that scp2 run failed every time the SSH client ...
      (comp.security.ssh)