nologin: Attempted login by root on UNKNOWN
Darek M
darek at nyi.net
Wed Jul 19 00:51:59 UTC 2006
doug wrote:
> On Tue, 18 Jul 2006, Tuc at T-B-O-H wrote:
>
>> Hi,
>>
>> All of a sudden today I'm getting :
>>
>> nologin: Attempted login by root on UNKNOWN
>>
>>
>> on a server... Its happening QUITE a bit :
>>
>> Jul 18 13:16:01 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 13:16:01 asgard kernel: Jul 18 13:16:01 asgard nologin:
>> Attempted login b
>> y root on UNKNOWN
>> Jul 18 13:18:23 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 13:18:23 asgard kernel: Jul 18 13:18:23 asgard nologin:
>> Attempted login b
>> y root on UNKNOWN
>> Jul 18 13:19:25 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 13:19:25 asgard kernel: Jul 18 13:19:25 asgard nologin:
>> Attempted login b
>> y root on UNKNOWN
>> Jul 18 13:19:25 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 13:21:27 asgard kernel: Jul 18 13:19:25 asgard nologin:
>> Attempted login b
>> y root on UNKNOWN
>> Jul 18 13:30:56 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 13:30:56 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 13:55:11 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 13:55:11 asgard kernel: Jul 18 13:55:11 asgard nologin:
>> Attempted login b
>> y root on UNKNOWN
>> Jul 18 14:08:47 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 14:08:47 asgard kernel: Jul 18 14:08:47 asgard nologin:
>> Attempted login b
>> y root on UNKNOWN
>> Jul 18 14:21:02 asgard nologin: Attempted login by root on UNKNOWN
>> Jul 18 14:21:02 asgard kernel: Jul 18 14:21:02 asgard nologin:
>> Attempted login b
>> y root on UNKNOWN
>>
>> I'm not sure who/what/where to start looking. Ideas?
I believe that I've seen this before. If I remember correctly, the
UNKNOWN part happens because the connection was closed before sshd or
the system got info on the client's host. This is probably not very
accurate, but the overall result was that it was not cause for concern.
The only thing that this shows is that ssh is open to anyone, so you
might want to close it with a firewall, or within /etc/ssh/sshd_config
with the AllowUsers directive. Also within that file, you probably
should have PermitRootLogin set to "no".
Also look at the output of 'last' and 'last -f /var/log/wtmp.0 ...
wtmp.N' just to make sure root didn't log in.
- Darek
More information about the freebsd-questions
mailing list