nologin: Attempted login by root on UNKNOWN

[doug]

On Tue, 18 Jul 2006, Tuc at T-B-O-H wrote:

> Hi,
>
> 	All of a sudden today I'm getting :
>
> nologin: Attempted login by root on UNKNOWN
>
>
> 	on a server... Its happening QUITE a bit :
>
> Jul 18 13:16:01 asgard nologin: Attempted login by root on UNKNOWN
> Jul 18 13:16:01 asgard kernel: Jul 18 13:16:01 asgard nologin: Attempted login b
> y root on UNKNOWN
> Jul 18 13:18:23 asgard nologin: Attempted login by root on UNKNOWN
> Jul 18 13:18:23 asgard kernel: Jul 18 13:18:23 asgard nologin: Attempted login b
> y root on UNKNOWN
> Jul 18 13:19:25 asgard nologin: Attempted login by root on UNKNOWN
> Jul 18 13:19:25 asgard kernel: Jul 18 13:19:25 asgard nologin: Attempted login b
> y root on UNKNOWN
> Jul 18 13:19:25 asgard nologin: Attempted login by root on UNKNOWN
> Jul 18 13:21:27 asgard kernel: Jul 18 13:19:25 asgard nologin: Attempted login b
> y root on UNKNOWN
> Jul 18 13:30:56 asgard nologin: Attempted login by root on UNKNOWN
> Jul 18 13:30:56 asgard nologin: Attempted login by root on UNKNOWN
> Jul 18 13:55:11 asgard nologin: Attempted login by root on UNKNOWN
> Jul 18 13:55:11 asgard kernel: Jul 18 13:55:11 asgard nologin: Attempted login b
> y root on UNKNOWN
> Jul 18 14:08:47 asgard nologin: Attempted login by root on UNKNOWN
> Jul 18 14:08:47 asgard kernel: Jul 18 14:08:47 asgard nologin: Attempted login b
> y root on UNKNOWN
> Jul 18 14:21:02 asgard nologin: Attempted login by root on UNKNOWN
> Jul 18 14:21:02 asgard kernel: Jul 18 14:21:02 asgard nologin: Attempted login b
> y root on UNKNOWN
>
> 	 I'm not sure who/what/where to start looking.  Ideas?

What does /var/log/auth.log show?

> 		Thanks, Tuc
> _______________________________________________
> freebsd-questions at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"
>