Hallo Liste, hallo Holger,
 
hier noch einmal aktuelle / auffällige Dateien aus /var/log/
 
..../alternatives.log
update-alternatives 2016-05-14 09:11:12: run with --quiet --remove rlogin /usr/bin/ssh
update-alternatives 2016-05-14 09:11:12: run with --quiet --remove rcp /usr/bin/ssh
--------
 
..../fail2ban.log
2016-05-19 11:01:28,118 fail2ban.server : INFO   Stopping all jails
2016-05-19 11:01:28,194 fail2ban.actions.action: ERROR  iptables -D INPUT -p tcp -m multiport --dports ssh -j fail2ban-ssh
iptables -F fail2ban-ssh
iptables -X fail2ban-ssh returned 100
2016-05-19 11:01:28,194 fail2ban.jail   : INFO   Jail 'ssh' stopped
2016-05-19 11:01:28,194 fail2ban.server : INFO   Exiting Fail2ban
2016-05-19 11:02:59,110 fail2ban.server : INFO   Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.6
2016-05-19 11:02:59,118 fail2ban.jail   : INFO   Creating new jail 'ssh'
2016-05-19 11:02:59,119 fail2ban.jail   : INFO   Jail 'ssh' uses poller
2016-05-19 11:02:59,199 fail2ban.filter : INFO   Added logfile = /var/log/auth.log
2016-05-19 11:02:59,200 fail2ban.filter : INFO   Set maxRetry = 6
2016-05-19 11:02:59,200 fail2ban.filter : INFO   Set findtime = 600
2016-05-19 11:02:59,201 fail2ban.actions: INFO   Set banTime = 600
2016-05-19 11:02:59,228 fail2ban.jail   : INFO   Jail 'ssh' started
------
 
..../mail.err
May 14 00:00:49 server cyrus/notify[2837]: recvfrom failed: Interrupted system call
-------
 
Nach Anmeldeversuch bei Horde: (Tab im Browser geschlossen nach missglücktem Anmeldeversuch)
..../mail.log
May 19 11:23:35 server master[4613]: about to exec /usr/lib/cyrus/bin/imapd
May 19 11:23:35 server cyrus/imap[4613]: executed
May 19 11:23:35 server cyrus/imap[4613]: accepted connection
May 19 11:23:35 server cyrus/imap[4613]: fetching user_deny.db entry for 'gross'
May 19 11:23:35 server cyrus/imap[4613]: login: server.hgwt-intra.de [10.16.1.1] gross PLAIN User logged in
May 19 11:23:35 server cyrus/imap[4613]: fetching user_deny.db entry for 'gross'
May 19 11:23:35 server master[4614]: about to exec /usr/lib/cyrus/bin/imapd
May 19 11:23:35 server cyrus/imap[4614]: executed
May 19 11:23:35 server cyrus/imap[4614]: accepted connection
May 19 11:23:35 server cyrus/imap[4614]: fetching user_deny.db entry for 'gross'
May 19 11:23:35 server cyrus/imap[4614]: login: server.hgwt-intra.de [10.16.1.1] gross PLAIN User logged in
May 19 11:23:35 server cyrus/imap[4614]: fetching user_deny.db entry for 'gross'
May 19 11:23:35 server cyrus/imap[4614]: fetching user_deny.db entry for 'gross'
May 19 11:23:35 server cyrus/imap[4614]: open: user gross opened INBOX
May 19 11:23:35 server cyrus/imap[4614]: fetching user_deny.db entry for 'gross'
May 19 11:23:35 server cyrus/imap[4614]: fetching user_deny.db entry for 'gross'
May 19 11:23:35 server cyrus/imap[4613]: fetching user_deny.db entry for 'gross'
May 19 11:23:35  cyrus/imap[4613]: last message repeated 2 times
May 19 11:23:35 server cyrus/imap[4614]: USAGE gross user: 0.000000 sys: 0.004925
May 19 11:23:35 server cyrus/imap[4613]: USAGE gross user: 0.000000 sys: 0.007178
-----------
 
..../syslog
May 19 11:23:35 server master[4613]: about to exec /usr/lib/cyrus/bin/imapd
May 19 11:23:35 server cyrus/imap[4613]: executed
May 19 11:23:35 server cyrus/imap[4613]: accepted connection
May 19 11:23:35 server cyrus/imap[4613]: fetching user_deny.db entry for 'gross'
May 19 11:23:35 server cyrus/imap[4613]: login: server.hgwt-intra.de [10.16.1.1] gross PLAIN User logged in
May 19 11:23:35 server cyrus/imap[4613]: fetching user_deny.db entry for 'gross'
May 19 11:23:35 server master[4614]: about to exec /usr/lib/cyrus/bin/imapd
May 19 11:23:35 server cyrus/imap[4614]: executed
May 19 11:23:35 server cyrus/imap[4614]: accepted connection
May 19 11:23:35 server cyrus/imap[4614]: fetching user_deny.db entry for 'gross'
May 19 11:23:35 server cyrus/imap[4614]: login: server.hgwt-intra.de [10.16.1.1] gross PLAIN User logged in
May 19 11:23:35 server cyrus/imap[4614]: fetching user_deny.db entry for 'gross'
May 19 11:23:35 server cyrus/imap[4614]: fetching user_deny.db entry for 'gross'
May 19 11:23:35 server cyrus/imap[4614]: open: user gross opened INBOX
May 19 11:23:35 server cyrus/imap[4614]: fetching user_deny.db entry for 'gross'
May 19 11:23:35 server cyrus/imap[4614]: fetching user_deny.db entry for 'gross'
May 19 11:23:35 server cyrus/imap[4613]: fetching user_deny.db entry for 'gross'
May 19 11:23:35  cyrus/imap[4613]: last message repeated 2 times
May 19 11:23:35 server cyrus/imap[4614]: USAGE gross user: 0.000000 sys: 0.004925
May 19 11:23:35 server cyrus/imap[4613]: USAGE gross user: 0.000000 sys: 0.007178
May 19 11:24:36 server postfix/smtpd[4646]: connect from server.hgwt-intra.de[10.16.1.1]
May 19 11:24:36 server postfix/smtpd[4646]: disconnect from server.hgwt-intra.de[10.16.1.1]
May 19 11:25:01 server CRON[4667]: (www-data) CMD (   test -x /usr/bin/php && /usr/bin/php -q /usr/share/horde3/scripts/alarms.php > /dev/null 2>&1 || true)May 19 11:25:01 server CRON[4668]: (www-data) CMD ([ -f /usr/share/moodle/admin/cli/cron.php ] && /usr/bin/php -f /usr/share/moodle/admin/cli/cron.php > /dev/null)
May 19 11:25:01 server CRON[4669]: (www-data) CMD (test -x /usr/bin/php && ! test -f /tmp/kronolith-cron.lock && touch /tmp/kronolith-cron.lock && /usr/bin/php -q /usr/share/horde3/kronolith/scripts/reminders.php > /dev/null 2>&1 && rm -f /tmp/kronolith-cron.lock)
May 19 11:25:01 server CRON[4671]: (root) CMD (php -f /var/www/owncloud/cron.php)
May 19 11:25:01 server CRON[4672]: (www-data) CMD ([ -f /usr/share/moodle/admin/cli/cron.php ] && /usr/bin/php -f /usr/share/moodle/admin/cli/cron.php ] && /usr/bin/php -f /usr/share/moodle/admin/cli/cron.php > /dev/null)
May 19 11:25:03 server master[2173]: process 4613 exited, status 0
May 19 11:25:04 server master[2173]: process 4614 exited, status 0
---------
 
/var/log/horde/horde3.log    liefert Folgendes als letzte Einträge:
 
May 13 16:14:38 HORDE [error] [imp] Die kompilierte Templatedatei '/usr/share/horde3/lib/../imp/templates/login/login.html'  konnte nicht gespeichert werden. [pid 21195 on line 231 of "/usr/share/horde3/imp/lib/Template.php"]
May 13 16:15:16 HORDE [notice] [imp] Login success for kalkma [217.147.48.79] to {server.hgwt-intra.de:143 [imap/notls]} [pid 27729 on line 307 of "/usr/share/horde3/imp/lib/Session.php"]
May 13 16:15:16 HORDE [error] [imp] Die kompilierte Templatedatei '/usr/share/horde3/lib/../imp/templates/login/login.html' konnte nicht gespeichert werden. [pid 27729 on line 231 of "/usr/share/horde3/imp/lib/Template.php"]
May 13 16:15:30 HORDE [notice] [imp] Login success for kalkma [217.147.48.79] to {server.hgwt-intra.de:143 [imap/notls]} [pid 27729 on line 307 of "/usr/share/horde3/imp/lib/Session.php"]
May 13 16:15:31 HORDE [error] [imp] Die kompilierte Templatedatei '/usr/share/horde3/lib/../imp/templates/login/login.html' konnte nicht gespeichert werden. [pid 27729 on line 231 of "/usr/share/horde3/imp/lib/Template.php"]
May 13 16:15:40 HORDE [notice] [imp] Login success for kalkma [217.147.48.79] to {server.hgwt-intra.de:143 [imap/notls]} [pid 27729 on line 307 of "/usr/share/horde3/imp/lib/Session.php"]
May 13 16:15:41 HORDE [error] [imp] Die kompilierte Templatedatei '/usr/share/horde3/lib/../imp/templates/login/login.html' konnte nicht gespeichert werden. [pid 27729 on line 231 of "/usr/share/horde3/imp/lib/Template.php"]
May 13 16:15:49 HORDE [notice] [imp] Login success for kalkma [217.147.48.79] to {server.hgwt-intra.de:143 [imap/notls]} [pid 27729 on line 307 of "/usr/share/horde3/imp/lib/Session.php"]
May 13 16:15:49 HORDE [error] [imp] Die kompilierte Templatedatei '/usr/share/horde3/lib/../imp/templates/login/login.html' konnte nicht gespeichert werden. [pid 27729 on line 231 of "/usr/share/horde3/imp/lib/Template.php"]
May 13 16:15:59 HORDE [error] [imp] Die kompilierte Templatedatei '/usr/share/horde3/lib/../imp/templates/login/login.html' konnte nicht gespeichert werden. [pid 978 on line 231 of "/usr/share/horde3/imp/lib/Template.php"]
May 13 16:16:07 HORDE [notice] [imp] Login success for kalkma [217.147.48.79] to {server.hgwt-intra.de:143 [imap/notls]} [pid 20751 on line 307 of "/usr/share/horde3/imp/lib/Session.php"]
May 13 16:16:08 HORDE [error] [imp] Die kompilierte Templatedatei '/usr/share/horde3/lib/../imp/templates/login/login.html' konnte nicht gespeichert werden. [pid 20751 on line 231 of "/usr/share/horde3/imp/lib/Template.php"]
May 13 21:45:41 HORDE [error] [imp] Die kompilierte Templatedatei '/usr/share/horde3/lib/../imp/templates/login/login.html' konnte nicht gespeichert werden. [pid 3658 on line 231 of "/usr/share/horde3/imp/lib/Template.php"]
May 13 21:46:05 HORDE [notice] [imp] Login success for administrator [109.192.18.254] to {server.hgwt-intra.de:143 [imap/notls]} [pid 3657 on line 307 of "/usr/share/horde3/imp/lib/Session.php"]
May 13 21:46:06 HORDE [error] [imp] Die kompilierte Templatedatei '/usr/share/horde3/lib/../imp/templates/login/login.html' konnte nicht gespeichert werden. [pid 3657 on line 231 of "/usr/share/horde3/imp/lib/Template.php"]
May 13 21:46:11 HORDE [notice] [imp] Login success for administrator [109.192.18.254] to {server.hgwt-intra.de:143 [imap/notls]} [pid 3657 on line 307 of "/usr/share/horde3/imp/lib/Session.php"]
May 13 21:46:11 HORDE [error] [imp] Die kompilierte Templatedatei '/usr/share/horde3/lib/../imp/templates/login/login.html' konnte nicht gespeichert werden. [pid 3657 on line 231 of "/usr/share/horde3/imp/lib/Template.php"]
May 13 21:46:25 HORDE [notice] [imp] Login success for administrator [109.192.18.254] to {server.hgwt-intra.de:143 [imap/notls]}
------
 
/var/log/apache2/access.log liefert folgendes für den letzten Einlogversuch bei Horde:
 
87.144.198.221 - - [19/May/2016:11:23:28 +0200] "GET /horde3/login.php?url="" HTTP/1.1" 302 26 "-" "Mozilla/5.0 (Windows NT 6.1; rv:46.0) Gecko/20100101 Firefox/46.0"
87.144.198.221 - - [19/May/2016:11:23:29 +0200] "GET /horde3/imp/login.php?url="" HTTP/1.1" 200 3427 "-" "Mozilla/5.0 (Windows NT 6.1; rv:46.0) Gecko/20100101 Firefox/46.0"
87.144.198.221 - - [19/May/2016:11:23:35 +0200] "POST /horde3/imp/redirect.php HTTP/1.1" 302 26 "https://hgwt-intra.de/horde3/imp/login.php?url="" "Mozilla/5.0 (Windows NT 6.1; rv:46.0) Gecko/20100101 Firefox/46.0"
87.144.198.221 - - [19/May/2016:11:23:35 +0200] "GET /horde3/services/maintenance.php?domaintenance=1&module=imp HTTP/1.1" 302 20 "https://hgwt-intra.de/horde3/imp/login.php?url="" "Mozilla/5.0 (Windows NT 6.1; rv:46.0) Gecko/20100101 Firefox/46.0"
87.144.198.221 - - [19/May/2016:11:23:35 +0200] "GET /horde3/login.php?url="" HTTP/1.1" 302 26 "https://hgwt-intra.de/horde3/imp/login.php?url="" "Mozilla/5.0 (Windows NT 6.1; rv:46.0) Gecko/20100101 Firefox/46.0"
87.144.198.221 - - [19/May/2016:11:23:35 +0200] "GET /horde3/imp/login.php?url="" HTTP/1.1" 200 3427 "https://hgwt-intra.de/horde3/imp/login.php?url="" "Mozilla/5.0 (Windows NT 6.1; rv:46.0) Gecko/20100101 Firefox/46.0"
87.144.198.221 - - [19/May/2016:11:23:37 +0200] "GET / HTTP/1.1" 200 114 "-" "Mozilla/5.0 (Windows NT 6.1; rv:46.0) Gecko/20100101 Firefox/46.0"
87.144.198.221 - - [19/May/2016:11:23:37 +0200] "GET /hgwt-intra HTTP/1.1" 301 246 "-" "Mozilla/5.0 (Windows NT 6.1; rv:46.0) Gecko/20100101 Firefox/46.0"
-----------------
 
Viele Grüße
Daniel
_______________________________________________
linuxmuster-user mailing list
[email protected]
https://mail.lehrerpost.de/mailman/listinfo/linuxmuster-user

Antwort per Email an