Good day list,
I have 2 servers with replicated with rsync debian squeeze;
rsync-e 'ssh-v-l www-data'-avuz 192.168.1.2 :/ var / www / test / * / var /
www / test /.
On ssh, both know their public certificates, however at log connection
errors are generated in auth.log
Received From: web-server->/var/log/auth.log
Rule: 5720 fired (level 10) -> "Multiple SSHD authentication failures."
Portion of the log(s):
Oct 11 12:51:09 web-jmv sshd[24268]: Failed none for www-data from
10.16.1.3 port 52567 ssh2
Oct 11 12:50:09 web-jmv sshd[24243]: Failed none for www-data from
10.16.1.3 port 49593 ssh2
Oct 11 12:49:09 web-jmv sshd[24214]: Failed none for www-data from
10.16.1.3 port 49587 ssh2
Oct 11 12:49:09 web-jmv sshd[24217]: Failed none for www-data from
10.16.1.3 port 49588 ssh2
Oct 11 12:49:09 web-jmv sshd[24213]: Failed none for www-data from
10.16.1.3 port 49586 ssh2
Oct 11 12:48:09 web-jmv sshd[24188]: Failed none for www-data from
10.16.1.3 port 49574 ssh2
Oct 11 12:47:09 web-jmv sshd[24160]: Failed none for www-data from
10.16.1.3 port 49566 ssh2
--END OF NOTIFICATION
OSSEC HIDS Notification.
2012 Oct 11 12:51:10
Received From: web-jmv->/var/log/auth.log
Rule: 40112 fired (level 12) -> "Multiple authentication failures followed
by a success."
Portion of the log(s):
Oct 11 12:51:09 web-jmv sshd[24268]: Accepted publickey for www-data from
10.16.1.3 port 52567 ssh2
att.
--
_________________________________
http://www.esin.net.ve
Carlos Palacios
Linux User# 395648
Consultor Software Libre
tlf: 0416-6.18.35.68
Esp. en Redes y Linux Debian
