RE: Bestonsearch.com
"Esler, Joel - Contractor" <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <41C902FBC7F1EA47933D76631B1704EE244BAA@rcertsexch.rcert-s.army.mil> |
I've seen the NODEVssh action before. Usually this is a result of a cron job running ssh as a client. -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Terje Trane Sent: Monday, August 30, 2004 10:03 AM To: 'Intrusions List (GCIA Practicals)' Subject: [Intrusions] Bestonsearch.com What is going on here? Aug 30 10:40:42 webserver sshd(pam_unix)[22351]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=bestonsearch.com Aug 30 10:40:47 webserver sshd(pam_unix)[22353]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=bestonsearch.com user=root Aug 30 10:40:51 webserver sshd(pam_unix)[22355]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=bestonsearch.com user=root Aug 30 10:40:55 webserver sshd(pam_unix)[22357]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=bestonsearch.com user=root Aug 30 10:40:59 webserver sshd(pam_unix)[22359]: check pass; user unknown _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions