|
ru.nethack
- RU.NETHACK -------------------------------------------------------------------
From : Alex Kocharin 2:50/13 23 Feb 2008 06:40:26
To : All
Subject : читая логи ssh...
--------------------------------------------------------------------------------
===
Feb 17 17:55:16 jgg sshd[25748]: (pam_unix) authentication failure; logname=
uid=0 euid=0 tty=ssh ruser= rhost=219.239.218.162 user=root
Feb 17 17:55:18 jgg sshd[25748]: Failed password for root from 219.239.218.162
port 57757 ssh2
Feb 17 17:55:22 jgg sshd[25915]: Invalid user fluffy from 219.239.218.162
Feb 17 17:55:22 jgg sshd[25915]: (pam_unix) check pass; user unknown
Feb 17 17:55:22 jgg sshd[25915]: (pam_unix) authentication failure; logname=
uid=0 euid=0 tty=ssh ruser= rhost=219.239.218.162
Feb 17 17:55:24 jgg sshd[25915]: Failed password for invalid user fluffy from
219.239.218.162 port 58015 ssh2
Feb 17 17:55:28 jgg sshd[26069]: Invalid user admin from 219.239.218.162
Feb 17 17:55:28 jgg sshd[26069]: (pam_unix) check pass; user unknown
Feb 17 17:55:29 jgg sshd[26069]: (pam_unix) authentication failure; logname=
uid=0 euid=0 tty=ssh ruser= rhost=219.239.218.162
Feb 17 17:55:30 jgg sshd[26069]: Failed password for invalid user admin from
219.239.218.162 port 58284 ssh2
Feb 17 17:55:34 jgg sshd[26225]: Invalid user test from 219.239.218.162
Feb 17 17:55:34 jgg sshd[26225]: (pam_unix) check pass; user unknown
Feb 17 17:55:34 jgg sshd[26225]: (pam_unix) authentication failure; logname=
uid=0 euid=0 tty=ssh ruser= rhost=219.239.218.162
===
И подобной бяки - половина auth.log. С 10-ти ip адресов (Китай, Италия,
Тайланд...), то скан по паролям одного юзера, то по списку юзеров.
Что за фигня? Вирусы гуляют? Есть ли смысл что-нить делать?)
Из grep Inv:
===
Feb 20 20:19:49 jgg sshd[11964]: Invalid user lab from 69.60.115.14
Feb 20 20:19:56 jgg sshd[12136]: Invalid user oracle from 69.60.115.14
Feb 20 20:19:59 jgg sshd[12216]: Invalid user svn from 69.60.115.14
Feb 20 20:20:04 jgg sshd[13435]: Invalid user iraf from 69.60.115.14
Feb 20 20:20:07 jgg sshd[13923]: Invalid user swsoft from 69.60.115.14
Feb 20 20:20:10 jgg sshd[15415]: Invalid user production from 69.60.115.14
Feb 20 20:20:14 jgg sshd[16035]: Invalid user guest from 69.60.115.14
Feb 20 20:20:17 jgg sshd[17452]: Invalid user gast from 69.60.115.14
Feb 20 20:20:20 jgg sshd[17538]: Invalid user gast from 69.60.115.14
Feb 20 20:20:24 jgg sshd[17639]: Invalid user oliver from 69.60.115.14
Feb 20 20:20:28 jgg sshd[17733]: Invalid user sirsi from 69.60.115.14
Feb 20 20:20:32 jgg sshd[17809]: Invalid user nagios from 69.60.115.14
Feb 20 20:20:36 jgg sshd[17910]: Invalid user nagios from 69.60.115.14
Feb 20 20:20:39 jgg sshd[17984]: Invalid user nagios from 69.60.115.14
Feb 20 20:20:43 jgg sshd[18087]: Invalid user nagios from 69.60.115.14
Feb 20 20:20:46 jgg sshd[18180]: Invalid user backuppc from 69.60.115.14
===
Alex
--- GoldED+/LNX 1.1.5-b20070503
* Origin: ----> Default GoldED Origin <---- (2:50/13)
Вернуться к списку тем, сортированных по: возрастание даты уменьшение даты тема автор
|
