user trying to login but failed

asad83 · 05-03-2009, 01:44 AM

Hi,

I have 2 servers A & B. both installed on different locations. both can ping and traceroute each other but there is no load shareing (both performing same functionality but independently). when i checked of server B /var/adm/messages, i can see that server A is trying to connect to server B but getting failed. and this is going on for long time. i mean it's not like someone manually try to enter but automatically its happening. i have already checked in cronjob but there is nothing. here are the logs,

May 3 11:01:27 Server A sshd[19269]: [ID 800047 auth.info] Failed password for user_id from 10.xxx.xxx.xxx port 53350 ssh2
May 3 11:01:27 Server A sshd[19271]: [ID 800047 auth.info] Failed password for user_id from 10.xxx.xxx.xxx port 53351 ssh2
May 3 11:01:27 Server A last message repeated 2 times

I would really appriciate some help on this. btw, there is no id_rsa or id_dsa file.

BR /asad

unSpawn · 05-03-2009, 04:04 AM

Can you check on server A what kind of user (system or human) "user_id" is? If it is a system user, is it for some monitoring or syncing application? If that doesn't reveal anything, is there sufficient network and process logging on server A to correlate logline times to reconstruct something?

asad83 · 05-03-2009, 04:29 AM

Hi Spawn,

well, the user is the default user of the system. and i checked yesterday's logging, and it revealed that last time i got this failed login message was 1544hrs and that time i was logged into the system and i left system at 1730hrs. and this message again started coming this morning at 10044hrs. now, point s, if there is no script running and there is no entry in cronjob, how can i find what's going on?

BR /asad

unSpawn · 05-03-2009, 07:02 PM

Quote:

Originally Posted by asad83

well, the user is the default user of the system.

Please be more specific. The name of the user might be a clue.

Quote:

Originally Posted by asad83

if there is no script running and there is no entry in cronjob, how can i find what's going on?

Please be more specific. Crontab as in "crontab -l" or /etc/crontab or 'cat /var/spool/cron/*'? Also post the distribution and major kernel version (as in 2.4 or 2.6). And do you have a list of networked software on server A? You could continuously run 'netstat -antpe' to show the PID and UID of networked processes, 'lsof -P -n -i tcp:22' would do the same, run Auditd if your distro allows it or just block traffic to the host/port and see what breaks. Also see 'last', 'who', 'lastlog', 'lastb' to get a fix on human/system users. Posting back verbosely would be appreciated.