Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[Solved] Illegal users, logwatch question
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
Sedrik
l33t
l33t


Joined: 08 Apr 2005
Posts: 655
Location: Uppsala, Sweden

PostPosted: Tue Oct 04, 2011 6:36 am    Post subject: [Solved] Illegal users, logwatch question Reply with quote

Hi guys and gals

Noted this today and I am wondering what it means (currently at work so can't read through the man page)

What is the difference between Illegal users and Login attempted?

Code:

 Illegal users from:
   49.212.64.138 (h-sys.biz): 1 time
   59.67.168.253 (mail.tjrac.edu.cn): 9 times
   88.191.74.240 (sd-13527.dedibox.fr): 9 times
   202.28.201.13: 6 times
   221.4.200.196: 7 times

 Login attempted when not in AllowUsers list:
   bin : 6 Time(s)
   daemon : 4 Time(s)
   mysql : 1 Time(s)
   nobody : 1 Time(s)
   root : 948 Time(s)
   sshd : 1 Time(s)

_________________
From Gentoo with love


Last edited by Sedrik on Tue Nov 01, 2011 6:31 pm; edited 1 time in total
Back to top
View user's profile Send private message
cach0rr0
Bodhisattva
Bodhisattva


Joined: 13 Nov 2008
Posts: 4123
Location: Houston, Republic of Texas

PostPosted: Tue Oct 04, 2011 6:42 am    Post subject: Reply with quote

the former == people trying to login as non-existent users
the latter == people trying to login as existing users, but ones that arent allowed to login via ssh

NB: if you cant do key-based auth, or change the ssh port, you should really look at deploying something like fail2ban
_________________
Lost configuring your system?
dump lspci -n here | see Pappy's guide | Link Stash
Back to top
View user's profile Send private message
Sedrik
l33t
l33t


Joined: 08 Apr 2005
Posts: 655
Location: Uppsala, Sweden

PostPosted: Tue Nov 01, 2011 6:30 pm    Post subject: Reply with quote

I am planning on setting up key based login, just havent had time to do it yet. Will look into it.

Thanks
_________________
From Gentoo with love
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum