Re: [gentoo-security] SSH login attempts and /var/log/wtmp

[Bryan O'Shea]

On Mon, 2 Aug 2004, Bryan O'Shea wrote:

> I have had these scans/logins attempted on one of my servers.
> I see all the attempts for guest,admin,test in my logs.
> They also show up when i run the command 'last'
> to see what users obviously have last logged in and a user test
> shows up.  The log in time shows for 0 time logged in.  I did not know that
> incorrect login attempts would show in the output of the command 'last' or
> even users that don't exist on the system.
> Maybe someone can explain what this means?

After further investigation I have gone through all my backup logs and 
noticed a user test was installed on the attempts in question.  The user 
was later deleted by a bulk user cleanup script I run to delete old 
accounts. I further saw login attempts in my logs for the user test
after the account was deleted and no entries showed up in my 'last' 
output on further login attempts. I had the shell set to /bin/false.

So far this is the only explanation I have to account for the 'last' 
entries.  Sorry if i alarmed anyone but wanted to be safe instead of 
sorry.

Thanks for the input



--
gentoo-security@g.o mailing list