Date: Tue, 18 Jul 2006 19:59:34 -0400 (EDT) From: doug <doug@fledge.watson.org> To: Tuc at T-B-O-H <ml@t-b-o-h.net> Cc: freebsd-questions@freebsd.org Subject: Re: nologin: Attempted login by root on UNKNOWN Message-ID: <20060718195841.B54217@fledge.watson.org> In-Reply-To: <200607182256.k6IMuleF051373@vjofn.tucs-beachin-obx-house.com> References: <200607182256.k6IMuleF051373@vjofn.tucs-beachin-obx-house.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 18 Jul 2006, Tuc at T-B-O-H wrote: > Hi, > > All of a sudden today I'm getting : > > nologin: Attempted login by root on UNKNOWN > > > on a server... Its happening QUITE a bit : > > Jul 18 13:16:01 asgard nologin: Attempted login by root on UNKNOWN > Jul 18 13:16:01 asgard kernel: Jul 18 13:16:01 asgard nologin: Attempted login b > y root on UNKNOWN > Jul 18 13:18:23 asgard nologin: Attempted login by root on UNKNOWN > Jul 18 13:18:23 asgard kernel: Jul 18 13:18:23 asgard nologin: Attempted login b > y root on UNKNOWN > Jul 18 13:19:25 asgard nologin: Attempted login by root on UNKNOWN > Jul 18 13:19:25 asgard kernel: Jul 18 13:19:25 asgard nologin: Attempted login b > y root on UNKNOWN > Jul 18 13:19:25 asgard nologin: Attempted login by root on UNKNOWN > Jul 18 13:21:27 asgard kernel: Jul 18 13:19:25 asgard nologin: Attempted login b > y root on UNKNOWN > Jul 18 13:30:56 asgard nologin: Attempted login by root on UNKNOWN > Jul 18 13:30:56 asgard nologin: Attempted login by root on UNKNOWN > Jul 18 13:55:11 asgard nologin: Attempted login by root on UNKNOWN > Jul 18 13:55:11 asgard kernel: Jul 18 13:55:11 asgard nologin: Attempted login b > y root on UNKNOWN > Jul 18 14:08:47 asgard nologin: Attempted login by root on UNKNOWN > Jul 18 14:08:47 asgard kernel: Jul 18 14:08:47 asgard nologin: Attempted login b > y root on UNKNOWN > Jul 18 14:21:02 asgard nologin: Attempted login by root on UNKNOWN > Jul 18 14:21:02 asgard kernel: Jul 18 14:21:02 asgard nologin: Attempted login b > y root on UNKNOWN > > I'm not sure who/what/where to start looking. Ideas? What does /var/log/auth.log show? > Thanks, Tuc > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org" >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060718195841.B54217>