Re: [webmin-l] Understanding daily "LogWatch"?

[Vern <ve...@cw...>]

These are attempted hacks (logon failures) into your box. Many are create=
d by=20
dictionary password crack programs that are used to attempt to figure out=
 user name=20
and passwords on your box. I used to get these and figured the best thing=
 to do is to=20
block the ssh port (tcp port 22) and only allow specific IP addresses, th=
at I specify,=20
access to that port.=20

---------- Original Message -----------=20
From: "pr...@pr..." <pr...@pr...>=20
To: web...@li...=20
Sent: Sun, 18 Sep 2005 16:22:56 -0700=20
Subject: [webmin-l] Understanding daily "LogWatch"?

> From: Prodos (Melbourne, Australia)=20
>=20
> Good morning.=20
>=20
> I receive a daily email from my WEBMIN server=20
> called "LogWatch for prodos"=20
>=20
> It starts off like this ....=20
>=20
> - - -=20
> ################### LogWatch 4.3.2 (02/18/03) ####################=20
> =A0 =A0 =A0Processing Initiated: Mon Sep 19 04:02:04 2005=20
> =A0 =A0 =A0Date Range Processed: yesterday=20
> =A0 =A0Detail Level of Output: 0=20
> =A0 =A0 =A0 =A0 Logfiles for Host: prodos=20
> ################################################################=20
> - - -=20
>=20
> ... and then lists all sorts of things, such as this ....=20
>=20
> - - -=20
> sshd:=20
> =A0Invalid Users:=20
> =A0 =A0 Unknown Account: 2614 Time(s)=20
> =A0Authentication Failures:=20
> =A0 =A0 mail (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 5 Time=
(s)=20
> =A0 =A0 unknown (220.229.161.171 ): 2211 Time(s)=20
> =A0 =A0 root (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 85 Tim=
e(s)=20
> =A0 =A0 sshd (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 5 Time=
(s)=20
> =A0 =A0 nobody (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 5=20
> Time(s)=20
> =A0 =A0 nobody (220.229.161.171 ): 3 Time(s)=20
> =A0 =A0 sshd (220.229.161.171 ): 9 Time(s)=20
>=20
> [etc.]=20
> - - - -=20
>=20
> And this ....=20
>=20
> - - - -=20
> --------------------- SSHD Begin ------------------------=20
>=20
> Failed logins from these:=20
> =A0Aaliyah/password from 200.102.192.82: 5 Time(s)=20
> =A0Aaron/password from 200.102.192.82: 5 Time(s)=20
> =A0Aba/password from 200.102.192.82: 5 Time(s)=20
> =A0Abel/password from 200.102.192.82: 5 Time(s)=20
> =A0Chicago/password from 220.229.161.171: 6 Time(s)=20
> =A0Christ/password from 220.229.161.171: 3 Time(s)=20
> =A0Dakota/password from 220.229.161.171: 6 Time(s)=20
> =A0Jewel/password from 200.102.192.82: 5 Time(s)=20
> =A0Jordan/password from 220.229.161.171: 6 Time(s)=20
>=20
> [etc.]=20
> - - -=20
>=20
> And this ...=20
>=20
> - - -=20
> **Unmatched Entries**=20
> Illegal user zena from 220.229.161.171=20
> Illegal user zena from 220.229.161.171=20
> Illegal user purple from 220.229.161.171=20
> Illegal user purple from 220.229.161.171=20
>=20
> [etc.]=20
> - - -=20
>=20
> Some of the lists are VERY long!=20
>=20
> Is there a reference guide somewhere that can help=20
> me interpret what the different categories and listed=20
> items mean and what action is advisable in each case?=20
>=20
> Thanks for any help on this.=20
>=20
> Best Wishes,=20
>=20
> PRODOS=20
>=20
> http://prodos.thinkertothinker.com=20
>=20
> -------------------------------------------------------=20
> SF.Net email is sponsored by:=20
> Tame your development challenges with Apache's Geronimo App Server. Dow=
nload=20
> it for free - -and be entered to win a 42" plasma tv or your very own=20
> Sony(tm)PSP. =A0Click here to play: http://sourceforge.net/geronimo.php=
=20
> -=20
> Forwarded by the Webmin mailing list at web...@li...=
.net=20
> To remove yourself from this list, go to=20
> http://lists.sourceforge.net/lists/listinfo/webadmin-list=20
------- End of Original Message -------