Tuc at T-B-O-H.NET wrote:
Jul 18 14:21:02 asgard nologin: Attempted login by root on UNKNOWN
Jul 18 14:21:02 asgard kernel: Jul 18 14:21:02 asgard nologin:
Attempted login by root on UNKNOWN
I'm not sure who/what/where to start looking. Ideas?
Hey Darek,
Tuc at T-B-O-H.NET wrote:
Jul 18 14:08:47 asgard nologin: Attempted login by root on UNKNOWN
Something running *as* root is trying to su to an account which has
/bin/nologin as a shell
e.g. # su avahi
cartman nologin: Attempted login by alex on /dev/ttyp7
avahi:*:558:558:Avahi
Tuc at T-B-O-H.NET wrote:
Jul 18 14:08:47 asgard nologin: Attempted login by root on UNKNOWN
Something running *as* root is trying to su to an account which has
/bin/nologin as a shell
e.g. # su avahi
cartman nologin: Attempted login by alex on /dev/ttyp7
On Tue, 18 Jul 2006, Tuc at T-B-O-H wrote:
Hi,
All of a sudden today I'm getting :
nologin: Attempted login by root on UNKNOWN
on a server... Its happening QUITE a bit :
Jul 18 13:16:01 asgard nologin: Attempted login by root on UNKNOWN
Jul 18 13:16:01 asgard kernel: Jul 18
doug wrote:
On Tue, 18 Jul 2006, Tuc at T-B-O-H wrote:
Hi,
All of a sudden today I'm getting :
nologin: Attempted login by root on UNKNOWN
on a server... Its happening QUITE a bit :
Jul 18 13:16:01 asgard nologin: Attempted login by root on UNKNOWN
Jul 18 13:16:01 asgard kernel:
Jul 18 14:21:02 asgard nologin: Attempted login by root on UNKNOWN
Jul 18 14:21:02 asgard kernel: Jul 18 14:21:02 asgard nologin:
Attempted login by root on UNKNOWN
I'm not sure who/what/where to start looking. Ideas?
Hey Darek,
Good to hear from NYI. :)
I believe
Jul 18 14:08:47 asgard nologin: Attempted login by root on UNKNOWN
Jul 18 14:08:47 asgard kernel: Jul 18 14:08:47 asgard nologin: Attempted
login by root on UNKNOWN
Jul 18 14:21:02 asgard nologin: Attempted login by root on UNKNOWN
Jul 18 14:21:02 asgard kernel: Jul 18 14:21:02 asgard
Tuc at T-B-O-H.NET wrote:
Jul 18 14:21:02 asgard nologin: Attempted login by root on UNKNOWN
Jul 18 14:21:02 asgard kernel: Jul 18 14:21:02 asgard nologin:
Attempted login by root on UNKNOWN
I'm not sure who/what/where to start looking. Ideas?
Hey Darek,
Good to hear