Ive investigated this further as I saw in logwatch ...
Login attempted when not in AllowUsers list:
mysql : 5 Time(s)
nobody : 62 Time(s)
root : 215 Time(s)which seemed a bit excessive with ossec running. attached are three files ossec-prob.log - from auth.log shows the attack started at 8:02 ossec-alerts-16.log.gz - the alerts log shows block at 8:24 ossec.log - shows a problem connecting to the ar queue. Question 1: Is it correct behaviour that it took twenty two minutes to block the attack? Question 2: Any ideas on the ar queue connection problem? Is it connected to problem 1? I tried restarting ossec but the same error came up. This is ossec 1.4 running on debian, kernel 2.6.22-3-686. Thanks. -- Regards Martin West
2007/12/17 08:48:31 ossec-logcollector(1950): Analyzing file: '/var/log/messages'. 2007/12/17 08:48:31 ossec-logcollector(1950): Analyzing file: '/var/log/auth.log'. 2007/12/17 08:48:31 ossec-logcollector(1950): Analyzing file: '/var/log/syslog'. 2007/12/17 08:48:31 ossec-logcollector(1950): Analyzing file: '/var/log/mail.info'. 2007/12/17 08:48:31 ossec-logcollector(1950): Analyzing file: '/var/log/apache2/error.log'. 2007/12/17 08:48:31 ossec-logcollector(1950): Analyzing file: '/var/log/apache2/access.log'. 2007/12/17 08:48:31 ossec-logcollector: Started (pid: 29023). 2007/12/17 08:48:31 ossec-analysisd(1210): Queue '/queue/alerts/ar' not accessible: 'Connection refused'. 2007/12/17 08:48:31 ossec-analysisd(1301): Unable to connect to active response queue. 2007/12/17 08:48:31 ossec-analysisd: Connected to '/queue/alerts/execq' (exec queue)
ossec-alerts-16.log.gz
Description: GNU Zip compressed data
Dec 16 08:02:38 thecla2 sshd[12042]: Did not receive identification string from 203.250.179.11 Dec 16 08:05:36 thecla2 sshd[12386]: User mysql from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:05:39 thecla2 sshd[12394]: User mysql from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:05:42 thecla2 sshd[12402]: User mysql from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:05:45 thecla2 sshd[12410]: User mysql from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:05:48 thecla2 sshd[12416]: User mysql from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:05:51 thecla2 sshd[12424]: Invalid user mysqlshell from 203.250.179.11 Dec 16 08:05:54 thecla2 sshd[12432]: Invalid user mysqlshell from 203.250.179.11 Dec 16 08:05:57 thecla2 sshd[12440]: Invalid user apache from 203.250.179.11 Dec 16 08:06:00 thecla2 sshd[12448]: Invalid user apache from 203.250.179.11 Dec 16 08:06:03 thecla2 sshd[12456]: Invalid user apache from 203.250.179.11 Dec 16 08:06:06 thecla2 sshd[12463]: Invalid user apache from 203.250.179.11 Dec 16 08:06:09 thecla2 sshd[12471]: Invalid user apache from 203.250.179.11 Dec 16 08:06:12 thecla2 sshd[12479]: Invalid user apache from 203.250.179.11 Dec 16 08:06:15 thecla2 sshd[12486]: Invalid user apache from 203.250.179.11 Dec 16 08:06:18 thecla2 sshd[12495]: Invalid user apache from 203.250.179.11 Dec 16 08:06:21 thecla2 sshd[12503]: Invalid user apache2 from 203.250.179.11 Dec 16 08:06:24 thecla2 sshd[12510]: Invalid user apache2 from 203.250.179.11 Dec 16 08:06:27 thecla2 sshd[12518]: Invalid user apache2 from 203.250.179.11 Dec 16 08:06:30 thecla2 sshd[12526]: Invalid user apache2 from 203.250.179.11 Dec 16 08:06:33 thecla2 sshd[12534]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:06:36 thecla2 sshd[12541]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:06:39 thecla2 sshd[12549]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:06:42 thecla2 sshd[12557]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:06:45 thecla2 sshd[12565]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:06:48 thecla2 sshd[12573]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:06:51 thecla2 sshd[12579]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:06:54 thecla2 sshd[12588]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:06:57 thecla2 sshd[12595]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:00 thecla2 sshd[12603]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:03 thecla2 sshd[12611]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:06 thecla2 sshd[12623]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:09 thecla2 sshd[12631]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:12 thecla2 sshd[12639]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:15 thecla2 sshd[12647]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:18 thecla2 sshd[12654]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:21 thecla2 sshd[12662]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:24 thecla2 sshd[12670]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:27 thecla2 sshd[12676]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:30 thecla2 sshd[12685]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:33 thecla2 sshd[12692]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:36 thecla2 sshd[12700]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:39 thecla2 sshd[12710]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:42 thecla2 sshd[12718]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:45 thecla2 sshd[12726]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:48 thecla2 sshd[12733]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:51 thecla2 sshd[12741]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:54 thecla2 sshd[12749]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:56 thecla2 sshd[12756]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:07:59 thecla2 sshd[12764]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:02 thecla2 sshd[12772]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:06 thecla2 sshd[12779]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:09 thecla2 sshd[12787]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:11 thecla2 sshd[12795]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:14 thecla2 sshd[12803]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:17 thecla2 sshd[12811]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:20 thecla2 sshd[12819]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:23 thecla2 sshd[12827]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:26 thecla2 sshd[12833]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:29 thecla2 sshd[12841]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:32 thecla2 sshd[12849]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:35 thecla2 sshd[12857]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:38 thecla2 sshd[12865]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:41 thecla2 sshd[12873]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:44 thecla2 sshd[12881]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:47 thecla2 sshd[12889]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:50 thecla2 sshd[12897]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:53 thecla2 sshd[12904]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:56 thecla2 sshd[12912]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:08:59 thecla2 sshd[12920]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:02 thecla2 sshd[12927]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:05 thecla2 sshd[12951]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:08 thecla2 sshd[12959]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:11 thecla2 sshd[12967]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:14 thecla2 sshd[12974]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:17 thecla2 sshd[12982]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:20 thecla2 sshd[12990]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:23 thecla2 sshd[12998]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:26 thecla2 sshd[13006]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:29 thecla2 sshd[13014]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:32 thecla2 sshd[13020]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:35 thecla2 sshd[13028]: User nobody from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:38 thecla2 sshd[13036]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:41 thecla2 sshd[13044]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:44 thecla2 sshd[13052]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:47 thecla2 sshd[13060]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:50 thecla2 sshd[13068]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:53 thecla2 sshd[13075]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:56 thecla2 sshd[13083]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:09:59 thecla2 sshd[13091]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:02 thecla2 sshd[13098]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:05 thecla2 sshd[13108]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:08 thecla2 sshd[13115]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:11 thecla2 sshd[13123]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:14 thecla2 sshd[13132]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:17 thecla2 sshd[13140]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:20 thecla2 sshd[13148]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:22 thecla2 sshd[13156]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:26 thecla2 sshd[13162]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:29 thecla2 sshd[13171]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:32 thecla2 sshd[13179]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:35 thecla2 sshd[13186]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:38 thecla2 sshd[13194]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:41 thecla2 sshd[13202]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:43 thecla2 sshd[13210]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:46 thecla2 sshd[13217]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:49 thecla2 sshd[13225]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:52 thecla2 sshd[13233]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:55 thecla2 sshd[13241]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:10:58 thecla2 sshd[13248]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:02 thecla2 sshd[13256]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:04 thecla2 sshd[13264]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:07 thecla2 sshd[13272]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:10 thecla2 sshd[13279]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:13 thecla2 sshd[13287]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:16 thecla2 sshd[13295]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:19 thecla2 sshd[13303]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:22 thecla2 sshd[13310]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:25 thecla2 sshd[13318]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:28 thecla2 sshd[13325]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:31 thecla2 sshd[13333]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:34 thecla2 sshd[13341]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:37 thecla2 sshd[13349]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:40 thecla2 sshd[13357]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:43 thecla2 sshd[13363]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:46 thecla2 sshd[13371]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:49 thecla2 sshd[13379]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:52 thecla2 sshd[13387]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:55 thecla2 sshd[13395]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:11:58 thecla2 sshd[13403]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:01 thecla2 sshd[13410]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:03 thecla2 sshd[13418]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:06 thecla2 sshd[13426]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:09 thecla2 sshd[13433]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:12 thecla2 sshd[13441]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:15 thecla2 sshd[13448]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:18 thecla2 sshd[13456]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:21 thecla2 sshd[13464]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:24 thecla2 sshd[13472]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:27 thecla2 sshd[13480]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:30 thecla2 sshd[13488]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:33 thecla2 sshd[13495]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:36 thecla2 sshd[13502]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:39 thecla2 sshd[13512]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:42 thecla2 sshd[13520]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:45 thecla2 sshd[13528]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:48 thecla2 sshd[13536]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:51 thecla2 sshd[13543]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:54 thecla2 sshd[13551]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:12:57 thecla2 sshd[13559]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:00 thecla2 sshd[13567]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:03 thecla2 sshd[13575]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:06 thecla2 sshd[13583]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:09 thecla2 sshd[13591]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:12 thecla2 sshd[13597]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:15 thecla2 sshd[13605]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:18 thecla2 sshd[13613]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:21 thecla2 sshd[13621]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:24 thecla2 sshd[13629]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:27 thecla2 sshd[13637]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:30 thecla2 sshd[13644]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:33 thecla2 sshd[13652]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:36 thecla2 sshd[13660]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:39 thecla2 sshd[13668]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:42 thecla2 sshd[13676]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:45 thecla2 sshd[13683]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:48 thecla2 sshd[13691]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:51 thecla2 sshd[13698]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:54 thecla2 sshd[13706]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:57 thecla2 sshd[13714]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:13:59 thecla2 sshd[13722]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:02 thecla2 sshd[13730]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:06 thecla2 sshd[13737]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:09 thecla2 sshd[13745]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:12 thecla2 sshd[13753]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:15 thecla2 sshd[13762]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:18 thecla2 sshd[13770]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:21 thecla2 sshd[13784]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:24 thecla2 sshd[13792]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:27 thecla2 sshd[13814]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:29 thecla2 sshd[13825]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:32 thecla2 sshd[13836]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:35 thecla2 sshd[13844]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:38 thecla2 sshd[13852]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:42 thecla2 sshd[13858]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:45 thecla2 sshd[13867]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:48 thecla2 sshd[13875]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:51 thecla2 sshd[13882]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:53 thecla2 sshd[13890]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:56 thecla2 sshd[13898]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:14:59 thecla2 sshd[13906]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:02 thecla2 sshd[13913]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:05 thecla2 sshd[13921]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:08 thecla2 sshd[13928]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:11 thecla2 sshd[13936]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:14 thecla2 sshd[13944]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:17 thecla2 sshd[13951]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:20 thecla2 sshd[13959]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:23 thecla2 sshd[13967]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:26 thecla2 sshd[13975]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:29 thecla2 sshd[13983]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:32 thecla2 sshd[13991]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:35 thecla2 sshd[13999]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:38 thecla2 sshd[14005]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:41 thecla2 sshd[14013]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:44 thecla2 sshd[14021]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:47 thecla2 sshd[14029]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:50 thecla2 sshd[14037]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:53 thecla2 sshd[14043]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:56 thecla2 sshd[14052]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:15:59 thecla2 sshd[14059]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:02 thecla2 sshd[14067]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:05 thecla2 sshd[14075]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:08 thecla2 sshd[14083]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:11 thecla2 sshd[14091]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:14 thecla2 sshd[14098]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:17 thecla2 sshd[14106]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:20 thecla2 sshd[14114]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:23 thecla2 sshd[14122]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:26 thecla2 sshd[14129]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:29 thecla2 sshd[14136]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:32 thecla2 sshd[14145]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:35 thecla2 sshd[14152]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:38 thecla2 sshd[14160]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:41 thecla2 sshd[14168]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:44 thecla2 sshd[14176]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:46 thecla2 sshd[14184]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:49 thecla2 sshd[14191]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:52 thecla2 sshd[14199]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:55 thecla2 sshd[14207]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:16:58 thecla2 sshd[14214]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:01 thecla2 sshd[14222]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:05 thecla2 sshd[14233]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:08 thecla2 sshd[14242]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:11 thecla2 sshd[14249]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:14 thecla2 sshd[14257]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:17 thecla2 sshd[14265]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:19 thecla2 sshd[14273]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:22 thecla2 sshd[14281]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:25 thecla2 sshd[14289]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:28 thecla2 sshd[14296]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:31 thecla2 sshd[14304]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:34 thecla2 sshd[14311]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:37 thecla2 sshd[14319]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:40 thecla2 sshd[14329]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:43 thecla2 sshd[14337]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:46 thecla2 sshd[14344]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:49 thecla2 sshd[14352]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:52 thecla2 sshd[14360]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:55 thecla2 sshd[14368]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:17:58 thecla2 sshd[14376]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:01 thecla2 sshd[14383]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:04 thecla2 sshd[14391]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:07 thecla2 sshd[14398]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:10 thecla2 sshd[14406]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:13 thecla2 sshd[14414]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:16 thecla2 sshd[14422]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:19 thecla2 sshd[14430]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:22 thecla2 sshd[14438]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:25 thecla2 sshd[14446]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:28 thecla2 sshd[14454]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:31 thecla2 sshd[14462]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:34 thecla2 sshd[14470]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:37 thecla2 sshd[14477]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:40 thecla2 sshd[14484]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:43 thecla2 sshd[14492]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:46 thecla2 sshd[14500]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:49 thecla2 sshd[14508]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:52 thecla2 sshd[14515]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:55 thecla2 sshd[14524]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:18:58 thecla2 sshd[14531]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:01 thecla2 sshd[14539]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:04 thecla2 sshd[14547]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:07 thecla2 sshd[14554]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:10 thecla2 sshd[14562]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:12 thecla2 sshd[14569]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:15 thecla2 sshd[14577]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:18 thecla2 sshd[14585]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:21 thecla2 sshd[14593]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:24 thecla2 sshd[14601]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:28 thecla2 sshd[14607]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:31 thecla2 sshd[14616]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:33 thecla2 sshd[14623]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:36 thecla2 sshd[14631]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:39 thecla2 sshd[14639]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:42 thecla2 sshd[14647]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:45 thecla2 sshd[14655]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:48 thecla2 sshd[14662]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:51 thecla2 sshd[14670]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:54 thecla2 sshd[14678]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:19:57 thecla2 sshd[14686]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:20:00 thecla2 sshd[14693]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:20:03 thecla2 sshd[14700]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:20:06 thecla2 sshd[14711]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:20:09 thecla2 sshd[14718]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:20:12 thecla2 sshd[14726]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:20:15 thecla2 sshd[14734]: User root from 203.250.179.11 not allowed because not listed in AllowUsers Dec 16 08:20:18 thecla2 sshd[14742]: Invalid user ftp from 203.250.179.11 Dec 16 08:20:21 thecla2 sshd[14750]: Invalid user ftp from 203.250.179.11 Dec 16 08:20:24 thecla2 sshd[14757]: Invalid user ftp from 203.250.179.11 Dec 16 08:20:27 thecla2 sshd[14765]: Invalid user ftp from 203.250.179.11 Dec 16 08:20:30 thecla2 sshd[14773]: Invalid user ftp from 203.250.179.11 Dec 16 08:20:33 thecla2 sshd[14780]: Invalid user ftp from 203.250.179.11 Dec 16 08:20:36 thecla2 sshd[14788]: Invalid user ftp from 203.250.179.11 Dec 16 08:20:39 thecla2 sshd[14796]: Invalid user ftp from 203.250.179.11 Dec 16 08:20:42 thecla2 sshd[14803]: Invalid user ftp from 203.250.179.11 Dec 16 08:20:45 thecla2 sshd[14811]: Invalid user ftp from 203.250.179.11 Dec 16 08:20:48 thecla2 sshd[14819]: Invalid user ftp from 203.250.179.11 Dec 16 08:20:51 thecla2 sshd[14827]: Invalid user ftp from 203.250.179.11 Dec 16 08:20:54 thecla2 sshd[14835]: Invalid user ftp from 203.250.179.11 Dec 16 08:20:56 thecla2 sshd[14843]: Invalid user ftp from 203.250.179.11 Dec 16 08:20:59 thecla2 sshd[14849]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:02 thecla2 sshd[14857]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:05 thecla2 sshd[14865]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:08 thecla2 sshd[14873]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:11 thecla2 sshd[14881]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:14 thecla2 sshd[14889]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:17 thecla2 sshd[14897]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:20 thecla2 sshd[14904]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:23 thecla2 sshd[14911]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:26 thecla2 sshd[14919]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:29 thecla2 sshd[14927]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:32 thecla2 sshd[14935]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:35 thecla2 sshd[14943]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:38 thecla2 sshd[14951]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:41 thecla2 sshd[14958]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:44 thecla2 sshd[14966]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:47 thecla2 sshd[14974]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:50 thecla2 sshd[14981]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:53 thecla2 sshd[14988]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:56 thecla2 sshd[14996]: Invalid user ftp from 203.250.179.11 Dec 16 08:21:59 thecla2 sshd[15004]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:02 thecla2 sshd[15012]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:05 thecla2 sshd[15020]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:08 thecla2 sshd[15028]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:11 thecla2 sshd[15035]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:13 thecla2 sshd[15043]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:16 thecla2 sshd[15050]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:19 thecla2 sshd[15058]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:22 thecla2 sshd[15065]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:25 thecla2 sshd[15073]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:28 thecla2 sshd[15081]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:31 thecla2 sshd[15089]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:34 thecla2 sshd[15097]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:37 thecla2 sshd[15105]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:40 thecla2 sshd[15115]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:43 thecla2 sshd[15121]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:46 thecla2 sshd[15129]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:49 thecla2 sshd[15137]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:52 thecla2 sshd[15145]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:55 thecla2 sshd[15153]: Invalid user ftp from 203.250.179.11 Dec 16 08:22:58 thecla2 sshd[15161]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:01 thecla2 sshd[15169]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:04 thecla2 sshd[15176]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:07 thecla2 sshd[15184]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:10 thecla2 sshd[15192]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:13 thecla2 sshd[15199]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:16 thecla2 sshd[15207]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:19 thecla2 sshd[15214]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:22 thecla2 sshd[15222]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:25 thecla2 sshd[15230]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:27 thecla2 sshd[15238]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:30 thecla2 sshd[15246]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:33 thecla2 sshd[15253]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:36 thecla2 sshd[15260]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:39 thecla2 sshd[15268]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:42 thecla2 sshd[15276]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:45 thecla2 sshd[15284]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:48 thecla2 sshd[15292]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:51 thecla2 sshd[15299]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:54 thecla2 sshd[15307]: Invalid user ftp from 203.250.179.11 Dec 16 08:23:57 thecla2 sshd[15315]: Invalid user ftp1 from 203.250.179.11 Dec 16 08:24:00 thecla2 sshd[15322]: Invalid user ftp1 from 203.250.179.11 Dec 16 08:24:03 thecla2 sshd[15330]: Invalid user ftp2 from 203.250.179.11 Dec 16 08:24:06 thecla2 sshd[15338]: Invalid user ftp2 from 203.250.179.11 Dec 16 08:24:09 thecla2 sshd[15345]: Invalid user ftp3 from 203.250.179.11 Dec 16 08:24:12 thecla2 sshd[15353]: Invalid user ftp3 from 203.250.179.11 Dec 16 08:24:15 thecla2 sshd[15361]: Invalid user ftpadmin from 203.250.179.11 Dec 16 08:24:18 thecla2 sshd[15368]: Invalid user ftpadmin from 203.250.179.11 Dec 16 08:24:21 thecla2 sshd[15375]: Invalid user ftpadmin from 203.250.179.11 Dec 16 08:24:24 thecla2 sshd[15383]: Invalid user ftpadmin from 203.250.179.11 Dec 16 08:24:27 thecla2 sshd[15391]: Invalid user ftpd from 203.250.179.11 Dec 16 08:24:30 thecla2 sshd[15399]: Invalid user ftpd from 203.250.179.11 Dec 16 08:24:33 thecla2 sshd[15407]: Invalid user ftpserver from 203.250.179.11 Dec 16 08:24:35 thecla2 sshd[15415]: Invalid user ftptest from 203.250.179.11 Dec 16 08:24:38 thecla2 sshd[15422]: Invalid user ftpuser from 203.250.179.11
