two copies of login in iptables

packets · 02-04-2007, 08:16 PM

Evertime time an IP is logging in via ssh, it was loggin in /var/log/secure. As I check /var/log/secure, there are two logs of logins. One is the actual time (8:48) and the other one is less 8 hours (0:048).

Feb 5 00:48:08 SERVER sshd[19937]: Accepted password for foo from ::ffff:X.X.X.X port 1597 ssh2
Feb 5 08:48:08 SERVER sshd[19936]: Accepted password for foo from ::ffff:X.X.X.X port 1597 ssh2

How can I remove the wrong log which is 00:48?

unSpawn · 02-04-2007, 08:34 PM

Please explain *why* it is wrong?

packets · 02-04-2007, 08:38 PM

Quote:

Originally Posted by unSpawn

Please explain *why* it is wrong?

The right log is 8:48 not 0:48. Just imagine if there are lots of ip that are logging in to the server.

unSpawn · 02-04-2007, 08:45 PM

What does running lsof or fuser on /var/log/secure return?

packets · 02-04-2007, 08:49 PM

I think lsof and fuser is not installed. It says "command not found"

Is this something to do with port as I change the port from 22 to 6500?

unSpawn · 02-05-2007, 04:33 AM

I think lsof and fuser is not installed. It says "command not found"
Are you running them as root account user? What's your $PATH like, then?

Is this something to do with port as I change the port from 22 to 6500?
I don't know. What steps did you take to move to that port?