From owner-freebsd-questions@FreeBSD.ORG  Wed Mar  9 10:24:57 2005
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 5ABD216A4CE
	for <freebsd-questions@freebsd.org>;
	Wed,  9 Mar 2005 10:24:57 +0000 (GMT)
Received: from mail.asarian-host.net (mail.asarian-host.net [194.109.160.70])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 64E8943D53
	for <freebsd-questions@freebsd.org>;
	Wed,  9 Mar 2005 10:24:55 +0000 (GMT)
	SRS0=Wl6+F4t7=RT=asarian-host.net=admin@asarian-host.net)
Received: from anonymizer.asarian-host.net (localhost [127.0.0.1])
	(authenticated bits=0)
	by mail.asarian-host.net (8.13.3/8.13.3) with ESMTP id j29AOsP7004892
	for <freebsd-questions@freebsd.org>;
	Wed, 9 Mar 2005 11:24:54 +0100 (CET)
	(envelope-from admin@asarian-host.net)
From: Mark <admin@asarian-host.net>
Received-SPF: pass (asarian-host.net: sender IP
	is authenticated by a trusted mechanism)
	receiver=asarian-host.net;
	client-ip=sender IP;
	envelope-from=<admin@asarian-host.net>;
	helo=asarian-host;
Message-Id: <200503091024.j29AOsEp004882@asarian-host.net>
Date: Wed, 09 Mar 2005 10:24:54 GMT
X-Authenticated-Sender: admin@asarian-host.net
X-Trace: t+1JjNPkXhqjrjrjftBjWpf5hG58TF8dJEiuKVFdVVsQSlYwAjoM6ZLUcMZCtKPfh0UN1rOEjziEJFk3vdWseA==
X-Complaints-To: abuse@asarian-host.net
X-Abuse-Info: Please be sure to forward a copy of ALL headers,
	otherwise we are unable to process your complaint
Organization: Asarian-host
To: "'FreeBSD-Questions Questions'" <freebsd-questions@freebsd.org>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-Auth: Asarian-host PGP signature
	iQEVAwUAQi7O9jFqW1BleBN9AQE/kAf/fnQs9WPwTayzKgIbZ8PAFiyZuEfyCJZP
	9epoNq2fpjst102je93m24cUakp2GL/i95oztJerAaIeXYEz6H6oAuZiNedLts/J
	wL+SSrm8HVF7f9dEIlYuUWUue8EfFYRaxyXrGfuq1kkSvi5MczP2iBHVjgemGyQ3
	2uwpKv+V7RohXHXMQR2cpjeFF7npzpP9qD/ze/Fas79Lpu2792YsEpU3a1HyaA03
	Rs64ivXVh8xxXpctSQZm0/og3OzzJMOJSy+3BtvnLArCnRCRklZk3zJM1oq8SYs0
	srYy95cDVdHvlS2YcYMiNXsBzHvpuJPStnpRSfXtRaQiinzUJ7I8uw==
	=QsA3
Subject: Auth.log date issue?
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Mar 2005 10:24:57 -0000


Running FreeBSD 4.10, today I saw this in my log:

asarian-host.net login failures:
Mar  8 22:11:20 asarian-host sshd[32810]: Failed password for asarian from
192.168.0.8 port 3535 ssh2
Mar  8 22:11:36 asarian-host sshd[32812]: Failed password for asarian from
192.168.0.8 port 3536 ssh2
Mar  8 22:11:39 asarian-host sshd[32814]: Failed password for asarian from
192.168.0.8 port 3537 ssh2

Which is curious, as the IP address no longer has a machine on it. Then I
checked, and after a while I suddenly noticed /var/log/auth.log was dated
March 8, 2004! Apparently, the security script just checks the date, but
not the year? Is it supposed to work this way? It gave me a good scare,
all for nothing. :)

Thanks,

- Mark