Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here. |
Notices |
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Are you new to LinuxQuestions.org? Visit the following links:
Site Howto |
Site FAQ |
Sitemap |
Register Now
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
|
 |
02-14-2006, 01:59 AM
|
#1
|
Member
Registered: Jul 2005
Location: West Coast South, USA
Distribution: debian 3.1
Posts: 267
Rep:
|
ssh logging options
Hi folks.
okay, i have googled for 20 minutes and searched this site a bit on this issue, haven't found an answer....
... to this:
I regularly check my logs. I am running debian sarge on three servers opened to the net to ssh only. When I examine /var/log/auth.log from time to time I (of course) see huge numbers of entries for invalid log-on attempts.
I can see when someone tries to log on as an illegal user:
Feb 13 10:08:21 danimalz-server sshd[5053]: Illegal user franziska from 210.118.254.248
I can see when someone tries to log on as a (sshd.conf) 'not-allowed' user:
Feb 13 10:19:28 danimalz-server sshd[5927]: User root not allowed because not listed in AllowUsers
... but I can never see when there is a failed password for a 'legal' user. I know this happens, i have tested it.
?? why is this ??
And what do I need to setup so that I can see invalid password attempts for legal users..?
Just curious (I have 18 character totally random passwords for the only 'allowed' users on my systems - so I am not afraid of any breakins )...
CHeeers,
Danimalz
|
|
|
02-14-2006, 02:57 AM
|
#2
|
Senior Member
Registered: Nov 2002
Location: British Columbia, Canada
Distribution: Gentoo x86_64; FreeBSD; OS X
Posts: 3,764
Rep:
|
My system logs these failed logins, but I believe it is PAM that does it.
Does your system use PAM?
|
|
|
02-14-2006, 03:35 AM
|
#3
|
Member
Registered: Jul 2005
Location: West Coast South, USA
Distribution: debian 3.1
Posts: 267
Original Poster
Rep:
|
Bulliver,
Thank you for ure reply..!
yes, my system is mostly standard sarge, so it uses PAM for authentication.
Here's the thing: I find it strang that when I:
cat /var/log/auth.og | grep samson
I never get entries that have been recorded in the log for this name. Yet the names 'sam' 'sams' , etc. appear many times in the logs as 'Illegal' users. So I wonder if the scans are actually trying 'samson' and I just do not know about it.
Thing is this occurred also for 'root' - ie: i never got logs for scans that tried 'root'. Yet when i restricted all users xcept one, within sshd.conf, root began appearing in the logs, so I know this name (obviously) was being tried. Therefore, I am worried that the names appearing in /etc/passwd do not appear in the logs, in my system, as 'invalid users', and thusly I'll never see when they are being tried with invalid passwords. (i hope this makes sense).
I just again tested, and can see that when I attempted to log on to 'samson' (assume that this user is in /etc/passwd) with a bad password, there is indeed a log (three times) for bad password (this is from PAM). Perhaps the scans are using a different login method, one that does not automatically log into /var/log/auth.log.
... sigh... ... anyhow thanks!...
Danimalz
|
|
|
All times are GMT -5. The time now is 02:02 PM.
|
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
|
Latest Threads
LQ News
|
|