Re: [gentoo-security] SSH login attempts and /var/log/wtmp

[Bryan O'Shea]

On Mon, 2 Aug 2004, Dan Margolis wrote:

> Incorrect login attempts should NOT show up (or at least they don't for
> me). This would imply that the user did log in successfully. Do you have
> a user by the name of ``test''? Perhaps with it's shell set to
> /bin/false so that it cannot log in to a working shell?

I have no user test in /etc/passwd or /etc/shadow:

This is a 2004.1 recently installed system
w/ latest sync and world updates
vanilla 2.4.26 kernel

last -a | grep test
test     pts/0        Tue Jul 27 00:45 - 00:45  (00:00)     80.28.219.40
test     pts/0        Sat Jul 24 17:29 - 17:29  (00:00)     210.143.106.131
test     pts/0        Sat Jul 24 11:10 - 11:10  (00:00)     61.109.156.5
test     pts/0        Sun Jul 18 22:08 - 22:08  (00:00)     66.165.234.7
test     pts/1        Thu Jul 15 09:03 - 09:03  (00:00)     mail.schedl-automotive.de
test     pts/0        Thu Jul 15 08:59 - 08:59  (00:00)     mail.schedl-automotive.de
test     pts/0        Thu Jul 15 08:57 - 08:57  (00:00)     mail.schedl-automotive.de
test     pts/0        Thu Jul 15 08:53 - 08:53  (00:00)     mail.schedl-automotive.de
test     pts/1        Wed Jul 14 12:37 - 12:37  (00:00)     host2-140.pool21758.interbusiness.it
test     pts/0        Tue Jul 13 01:23 - 01:23  (00:00)     216-55-164-10.dedicated.abac.net

>
> Or are you perhaps running an out of date version of OpenSSH (like, a
> year out of date)?

ssh -v
OpenSSH_3.8.1p1, OpenSSL 0.9.7d 17 Mar 2004

>
> Seeing as I've yet to hear of an exploit on a patched system with no
> vulnerable users/passwords, I had been assuming there is no 0day exploit
> out there to be concerned about. But perhaps you can confirm differently
> for us.

Since these login attempts have appeared I have been monitoring closely 
and have not experienced anymore attempts.



--
gentoo-security@g.o mailing list