root login denied. But by what?

2005-06-17 Thread David Ramsden 
Hi,

Logcheck has just given me three of the following:
Jun 17 17:17:15 hexstream [877]: root login denied [username: (0), IP/port: no 
ip?!]

Each one with a different PID. They appear in my /var/log/auth.log

I've never seen this type of message before but I've recently upgraded to the 
latest
release of stable.

Does anyone know what generated the above log entries? And why is there no ip?

Regards,
David.
-- 
 .''`. David Ramsden [EMAIL PROTECTED]
: :'  :http://david.hexstream.co.uk/
`. `'` PGP key ID: 507B379B on wwwkeys.pgp.net
  `-  Debian - when my girlfriend's away and there's nothing better to do.


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: root login denied. But by what?

2005-06-17 Thread Marcin Owsiany 
On Fri, Jun 17, 2005 at 07:33:02PM +0100, David Ramsden wrote:
 Does anyone know what generated the above log entries?

try:

find /usr/sbin /sbin /usr/local/sbin \
 /usr/bin /usr/local/bin /bin /usr/lib /lib -type f | \
while read f; do
 if strings $f | egrep -q 'no ip\?!'; then
   echo it's $f !
 fi
done

 And why is there no ip?

I guess this is a bug..

Marcin
-- 
Marcin Owsiany [EMAIL PROTECTED] http://marcin.owsiany.pl/
GnuPG: 1024D/60F41216  FE67 DA2D 0ACA FC5E 3F75  D6F6 3A0D 8AA0 60F4 1216


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: root login denied. But by what?

2005-06-17 Thread David Ramsden 
On Fri, Jun 17, 2005 at 10:47:49PM +0200, Marcin Owsiany wrote:
 On Fri, Jun 17, 2005 at 07:33:02PM +0100, David Ramsden wrote:
  Does anyone know what generated the above log entries?
 
 try:
 
 find /usr/sbin /sbin /usr/local/sbin \
  /usr/bin /usr/local/bin /bin /usr/lib /lib -type f | \
 while read f; do
  if strings $f | egrep -q 'no ip\?!'; then
echo it's $f !
  fi
 done
 

Thanks for that Marcin. Worked well and found the program that caused 
this.

It was scponly. I'm guessing a shell user ran it from an SSH session and 
it's generated the log entries. So nothing to worry about!

Thanks once again!
David.
-- 
 .''`. David Ramsden [EMAIL PROTECTED]
: :'  :http://david.hexstream.co.uk/
`. `'` PGP key ID: 507B379B on wwwkeys.pgp.net
  `-  Debian - when my girlfriend's away and there's nothing better to do.


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]