>
> Tuc at T-B-O-H.NET wrote:
>
> >>>Jul 18 14:08:47 asgard nologin: Attempted login by root on UNKNOWN
> >>>
> >>>
> Something running *as* root is trying to "su" to an account which has
> /bin/nologin as a shell
>
> e.g. # su avahi
>
> cartman nologin: Attempted login by alex on /dev/t
Tuc at T-B-O-H.NET wrote:
Jul 18 14:08:47 asgard nologin: Attempted login by root on UNKNOWN
Something running *as* root is trying to "su" to an account which has
/bin/nologin as a shell
e.g. # su avahi
cartman nologin: Attempted login by alex on /dev/ttyp7
avahi:*:558:558:Avahi Daem
>
> Tuc at T-B-O-H.NET wrote:
> Jul 18 14:21:02 asgard nologin: Attempted login by root on UNKNOWN
> Jul 18 14:21:02 asgard kernel: Jul 18 14:21:02 asgard nologin:
> Attempted login by root on UNKNOWN
>
> I'm not sure who/what/where to start looking. Ideas?
>
Tuc at T-B-O-H.NET wrote:
Jul 18 14:21:02 asgard nologin: Attempted login by root on UNKNOWN
Jul 18 14:21:02 asgard kernel: Jul 18 14:21:02 asgard nologin:
Attempted login by root on UNKNOWN
I'm not sure who/what/where to start looking. Ideas?
Hey Darek,
Good to hear f
> > Jul 18 14:08:47 asgard nologin: Attempted login by root on UNKNOWN
> > Jul 18 14:08:47 asgard kernel: Jul 18 14:08:47 asgard nologin: Attempted
> > login by root on UNKNOWN
> > Jul 18 14:21:02 asgard nologin: Attempted login by root on UNKNOWN
> > Jul 18 14:21:02 asgard kernel: Jul 18 14:21:02
> >> Jul 18 14:21:02 asgard nologin: Attempted login by root on UNKNOWN
> >> Jul 18 14:21:02 asgard kernel: Jul 18 14:21:02 asgard nologin:
> >> Attempted login by root on UNKNOWN
> >>
> >> I'm not sure who/what/where to start looking. Ideas?
>
Hey Darek,
Good to hear from NYI. :)
doug wrote:
On Tue, 18 Jul 2006, Tuc at T-B-O-H wrote:
Hi,
All of a sudden today I'm getting :
nologin: Attempted login by root on UNKNOWN
on a server... Its happening QUITE a bit :
Jul 18 13:16:01 asgard nologin: Attempted login by root on UNKNOWN
Jul 18 13:16:01 asgard kernel: Ju
On Tue, 18 Jul 2006, Tuc at T-B-O-H wrote:
Hi,
All of a sudden today I'm getting :
nologin: Attempted login by root on UNKNOWN
on a server... Its happening QUITE a bit :
Jul 18 13:16:01 asgard nologin: Attempted login by root on UNKNOWN
Jul 18 13:16:01 asgard kernel: Jul 18