Tuc at T-B-O-H.NET wrote:
Jul 18 14:21:02 asgard nologin: Attempted login by root on UNKNOWN
Jul 18 14:21:02 asgard kernel: Jul 18 14:21:02 asgard nologin: Attempted login by root on UNKNOWN


     I'm not sure who/what/where to start looking.  Ideas?
Hey Darek,

        Good to hear from NYI. :)

Heh, are you a customer, or just familiar with the company?

        SSH is TCPWrapper'd, and only *1* machine in the entire
datacenter can access it (Typical "jump box" configuration).

http://lists.debian.org/debian-wnpp/2006/05/msg00092.html

Does root have /bin/nologin for the shell? If it does, then the UNKNOWN would refer to the terminal, Just the way the 'nologin' binary is set to log to syslog. Basically means that someone tried to log in as root, but before they could even provide a password, the nologin binary kicked them off. That's why the terminal type is set to UNKNOWN because it hadn't been set yet.

You'll have to figure out how that person is getting access as apparently they are reaching the box.

- Darek
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to