RE: [sec] Re: failed root login attempts

2004-09-30 Thread Jasper Filon
] Cc: Noah Meyerhans Subject: Re: [sec] Re: failed root login attempts * Quoting Phillip Hofmeister ([EMAIL PROTECTED]): On Tue, 28 Sep 2004 at 09:18:51PM -0400, Noah Meyerhans wrote: That doesn't seem to be the case. The most common one uses root/test/guest, but there are more that seem

Re: [sec] Re: failed root login attempts

2004-09-29 Thread Phillip Hofmeister
On Tue, 28 Sep 2004 at 09:18:51PM -0400, Noah Meyerhans wrote: That doesn't seem to be the case. The most common one uses root/test/guest, but there are more that seem to be based on the same code. They all disconnect by sending the string Bye Bye, e.g.: sshd[13613]: Received disconnect from

Re: [sec] Re: failed root login attempts

2004-09-28 Thread Peter Cordes
On Tue, Sep 21, 2004 at 01:45:46PM +0100, Steve Kemp wrote: On Sun, 19 Sep 2004, martin f krafft wrote: If you ask me, logcheck should learn how to evaluate log messages in their context... If you want to have instant alerts of problems then logcheck is what you want. If you to

Re: [sec] Re: failed root login attempts

2004-09-21 Thread Steve Kemp
On Sun, 19 Sep 2004, martin f krafft wrote: If you ask me, logcheck should learn how to evaluate log messages in their context... If you want to have instant alerts of problems then logcheck is what you want. If you to ignore some things and still receive timely alerts then you're