On Tue, 23 Dec 2014, Atom Powers wrote: > I would argue that is isn't the cracking attempts that you should be > monitoring. Is is the cracking successes. Have there been any unusual > logins?
Atom, No, never. This is why I want to see the sshd log entries from /var/log/messages summarized by logwatch. > Honestly, failed attempts are meaningless (unless it is a DDOS, and then > monitoring them only exacerbates the problem); the successful logins are > interesting. I've never had a successful login from anyone but me and a colleague who worked on a project with me. Thanks, Rich _______________________________________________ PLUG mailing list [email protected] http://lists.pdxlinux.org/mailman/listinfo/plug
