Questions concerning Security Log

[Dotan Cohen]

On Apr 7, 2005 12:08 PM, Paul Howarth <paul at city-fan.org> wrote:
> Dotan Cohen wrote:
> > Thanks. I tryed to edit /etc/ssh/sshd_config and found that it is
> > either empty or does not exist. In emacs i just get a blank screen. So
> > maybe I don't even have ssh on this computer? I did a FC3 desktop
> > installation.
> 
> Do you have openssh-server installed?
> 
> $ rpm -qa 'openssh*'
> 
> It sounds a bit strange that you should have sshd alert messages in your
> logs if you're not running an ssh server.
> 
> See also what's listening on your ssh port:
> # netstat -nalp | grep :22
> 
> >>3. Consider turning off password authentication altogether and using
> >>certificates instead.
> >
> > I will look into this. As far as I can see, I would need to purchase a
> > certificate?
> 
> No, you generate them yourself.
> 
> There's an introduction at:
> http://www.everything2.com/index.pl?node=OpenSSH
> 
> Paul.
> 

> Do you have openssh-server installed?
> $ rpm -qa 'openssh*'

I got nothing in return. After some time thinking, the prompt returned.


> It sounds a bit strange that you should have sshd alert messages in your
> logs if you're not running an ssh server.
> See also what's listening on your ssh port:
> # netstat -nalp | grep :22

I got this:
tcp        0      0 :::22                       :::*                  
     LISTEN      4428/sshd

I pasted it as it is into google and got no results, but I did not go
digging any deeper. I figure it would be best to ask here what this
means.


Just a little question. For the rpm you used $ as the prompt sign, but
for the netstat you used #. Any difference between them, in your
usage?

Thank you so much.

Dotan Cohen

http://Liriks-Song.com/
http://Song-Liriks.com/