On 1/31/06, Paul Howarth <paul@xxxxxxxxxxxx> wrote: > Andrew Lennon wrote: > > Hi, > > > > While going through my daily logs I have noticed that pam is > > complaining about bad logins. I have had 7000 over the last 24hrs: > > > > --------------------- pam_unix Begin ------------------------ > > > > login: > > Authentication Failures: > > unknown (): 7728 Time(s) > > unknown ( ): 3638 Time(s) > > Invalid Users: > > Unknown Account: 11365 Time(s) > > Bad User: : 4086 Time(s) > > Bad User: XXXX XX XX XX XXXx: 1 Time(s) > > > > I Know its not ssh as the numbers don't add up. While checking > > /var/log/messages I am getting a continual stream of messages along > > the line of : > > > > Jan 31 10:28:06 ned login(pam_unix)[20441]: check pass; user unknown > > Jan 31 10:28:06 ned login(pam_unix)[20441]: authentication failure; > > logname= uid=0 euid=0 tt > > y=ttyS0 ruser= rhost= > > Jan 31 10:28:08 ned login[20441]: FAILED LOGIN 1 FROM (null) FOR > > Username: Ned, Authentication failure > > Jan 31 10:28:11 ned login(pam_unix)[20441]: check pass; user unknown > > Jan 31 10:28:11 ned login(pam_unix)[20441]: authentication failure; > > logname= uid=0 euid=0 tty=ttyS0 ruser= rhost= > > Jan 31 10:28:13 ned login[20441]: FAILED LOGIN 2 FROM (null) FOR C, > > Authentication failure > > Jan 31 10:28:14 ned login(pam_unix)[20441]: bad username [] > > Jan 31 10:28:16 ned login[20441]: FAILED LOGIN 3 FROM (null) FOR , > > Authentication failure > > Jan 31 10:28:22 ned login(pam_unix)[20441]: check pass; user unknown > > Jan 31 10:28:24 ned login[20441]: FAILED LOGIN SESSION FROM (null) FOR > > C, Authentication fai > > lure > > Jan 31 10:28:24 ned login(pam_unix)[20441]: 1 more authentication > > failure; logname= uid=0 eu > > id=0 tty=ttyS0 ruser= rhost= > > > > > > > > Any ideas how I can trace them down/tie the to a process etc. > > Try looking in /var/log/secure > > Paul. > > -- > fedora-list mailing list > fedora-list@xxxxxxxxxx > To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list > I did look in there previously and I can see a load of ssh attempts but I know that the output of var/log/messages is something different due to the frequency/amount/timestamps shown Thanks anyway. Andy
