The Planet Forums > Today's Logwatch

The Planet Forums > Security > General Security > UNIX Security

Enigma

Oct 8 2004, 08:12 AM

CODE

--------------------- pam_unix Begin ------------------------

sshd:

Authentication Failures:

root (26.67-19-230.reverse.theplanet.com ): 12 Time(s)

unknown (26.67-19-230.reverse.theplanet.com ): 24 Time(s)

Invalid Users:

Unknown Account: 24 Time(s)

does this mean that a customer from Servermatrix/The Planet has had their computer taken over?

autoquartz

Oct 8 2004, 09:32 PM

Those were authentication failures, which mean that they didn't get manage to get in to your system. I will probably guess that this is either an attempted attack from someone with access to any of the servers inside servermatrix or an owner just mixed up his IP with yours. Just my 2cents.

Ronny AcuNett

Oct 21 2004, 02:56 PM

If you get repeated attacks on root from inside or outside of the network I would suggest using an su user to login to root. Something other than "admin" preferrably.

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.