tracking down failed logins

[Andrew Lennon]

On 1/31/06, Paul Howarth <paul at city-fan.org> wrote:
> Andrew Lennon wrote:
> > Hi,
> >
> > While going through my daily logs I have noticed that pam is
> > complaining about bad logins.  I have had 7000 over the last 24hrs:
> >
> > --------------------- pam_unix Begin ------------------------
> >
> >  login:
> >     Authentication Failures:
> >        unknown (): 7728 Time(s)
> >        unknown ( ): 3638 Time(s)
> >     Invalid Users:
> >        Unknown Account: 11365 Time(s)
> >        Bad User: : 4086 Time(s)
> >        Bad User:   XXXX XX   XX  XX    XXXx: 1 Time(s)
> >
> > I Know its not ssh as the numbers don't add up.  While checking
> > /var/log/messages I am getting a continual stream of messages along
> > the line of :
> >
> > Jan 31 10:28:06 ned login(pam_unix)[20441]: check pass; user unknown
> > Jan 31 10:28:06 ned login(pam_unix)[20441]: authentication failure;
> > logname= uid=0 euid=0 tt
> > y=ttyS0 ruser= rhost=
> > Jan 31 10:28:08 ned login[20441]: FAILED LOGIN 1 FROM (null) FOR
> > Username: Ned, Authentication failure
> > Jan 31 10:28:11 ned login(pam_unix)[20441]: check pass; user unknown
> > Jan 31 10:28:11 ned login(pam_unix)[20441]: authentication failure;
> > logname= uid=0 euid=0 tty=ttyS0 ruser= rhost=
> > Jan 31 10:28:13 ned login[20441]: FAILED LOGIN 2 FROM (null) FOR C,
> > Authentication failure
> > Jan 31 10:28:14 ned login(pam_unix)[20441]: bad username []
> > Jan 31 10:28:16 ned login[20441]: FAILED LOGIN 3 FROM (null) FOR ,
> > Authentication failure
> > Jan 31 10:28:22 ned login(pam_unix)[20441]: check pass; user unknown
> > Jan 31 10:28:24 ned login[20441]: FAILED LOGIN SESSION FROM (null) FOR
> > C, Authentication fai
> > lure
> > Jan 31 10:28:24 ned login(pam_unix)[20441]: 1 more authentication
> > failure; logname= uid=0 eu
> > id=0 tty=ttyS0 ruser= rhost=
> >
> >
> >
> > Any ideas how I can trace them down/tie the to a process etc.
>
> Try looking in /var/log/secure
>
> Paul.
>
> --
> fedora-list mailing list
> fedora-list at redhat.com
> To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
>

I did look in there previously and I can see a load of ssh attempts
but I know that the output of var/log/messages is something different
due to the frequency/amount/timestamps shown

Thanks anyway.

Andy