nologin: Attempted login by root on UNKNOWN

[Darek M]

doug wrote:
> On Tue, 18 Jul 2006, Tuc at T-B-O-H wrote:
>
>> Hi,
>>
>>     All of a sudden today I'm getting :
>>
>> nologin: Attempted login by root on UNKNOWN
>>
>>
>>     on a server... Its happening QUITE a bit :
>>
>> Jul 18 13:16:01 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 13:16:01 asgard kernel: Jul 18 13:16:01 asgard nologin: 
>> Attempted login b
>> y root on UNKNOWN
>> Jul 18 13:18:23 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 13:18:23 asgard kernel: Jul 18 13:18:23 asgard nologin: 
>> Attempted login b
>> y root on UNKNOWN
>> Jul 18 13:19:25 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 13:19:25 asgard kernel: Jul 18 13:19:25 asgard nologin: 
>> Attempted login b
>> y root on UNKNOWN
>> Jul 18 13:19:25 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 13:21:27 asgard kernel: Jul 18 13:19:25 asgard nologin: 
>> Attempted login b
>> y root on UNKNOWN
>> Jul 18 13:30:56 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 13:30:56 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 13:55:11 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 13:55:11 asgard kernel: Jul 18 13:55:11 asgard nologin: 
>> Attempted login b
>> y root on UNKNOWN
>> Jul 18 14:08:47 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 14:08:47 asgard kernel: Jul 18 14:08:47 asgard nologin: 
>> Attempted login b
>> y root on UNKNOWN
>> Jul 18 14:21:02 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 14:21:02 asgard kernel: Jul 18 14:21:02 asgard nologin: 
>> Attempted login b
>> y root on UNKNOWN
>>
>>      I'm not sure who/what/where to start looking.  Ideas?

I believe that I've seen this before.  If I remember correctly, the 
UNKNOWN part happens because the connection was closed before sshd or 
the system got info on the client's host.  This is probably not very 
accurate, but the overall result was that it was not cause for concern.

The only thing that this shows is that ssh is open to anyone, so you 
might want to close it with a firewall, or within /etc/ssh/sshd_config 
with the AllowUsers directive.  Also within that file, you probably 
should have PermitRootLogin set to "no".

Also look at the output of 'last' and 'last -f /var/log/wtmp.0 ... 
wtmp.N' just to make sure root didn't log in.

- Darek