Tuc at T-B-O-H.NET wrote:
Jul 18 14:21:02 asgard nologin: Attempted login by root on UNKNOWN
Jul 18 14:21:02 asgard kernel: Jul 18 14:21:02 asgard nologin:
Attempted login by root on UNKNOWN
I'm not sure who/what/where to start looking. Ideas?
Good to hear from NYI. :)
Heh, are you a customer, or just familiar with the company?
SSH is TCPWrapper'd, and only *1* machine in the entire
datacenter can access it (Typical "jump box" configuration).
Does root have /bin/nologin for the shell? If it does, then the UNKNOWN
would refer to the terminal, Just the way the 'nologin' binary is set
to log to syslog. Basically means that someone tried to log in as root,
but before they could even provide a password, the nologin binary kicked
them off. That's why the terminal type is set to UNKNOWN because it
hadn't been set yet.
You'll have to figure out how that person is getting access as
apparently they are reaching the box.
email@example.com mailing list
To unsubscribe, send any mail to "[EMAIL PROTECTED]"