Date: Sun, 17 Oct 2010 13:16:46 +0200 From: Frederic Praca <frederic.praca@freebsd-fr.org> To: freebsd-questions@freebsd.org Subject: Re: Strange PAM message Message-ID: <20101017131646.514aea0f@coruscant.dnsalias.net> In-Reply-To: <AANLkTi=fvBU7svDT-oFseJSYQgJov7ndmEPked5F2-R3@mail.gmail.com> References: <20101016124725.63a7ac5a@coruscant.dnsalias.net> <AANLkTi=fvBU7svDT-oFseJSYQgJov7ndmEPked5F2-R3@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Well in fact, I guess this is an automated break-in attempt coming from a virus or troyan. But, I already got such attacks in the past and never had this strange PAM message. > You probably have somebody trying (succeeding?, I have no idea,) to > break in. >=20 > I have one machine for the net, but none of the machines I do my work > in ever get connected to the internet. It's like the old west, still > -- there really is no law enforcement. >=20 > --jg >=20 >=20 >=20 >=20 > On Sat, Oct 16, 2010 at 6:47 AM, Frederic Praca < > frederic.praca@freebsd-fr.org> wrote: >=20 > > Hello guys, > > has anyone got these messages : > > Oct 16 11:24:54 coruscant sshd[2690]: User root from 89.211.244.245 > > not allowed because none of user's groups are listed in AllowGroups > > Oct 16 11:24:55 coruscant sshd[2690]: fatal: Internal error: PAM > > auth succeeded when it should have failed > > > > FYI, I have a sshd server prohibiting root logins so the second log > > made me think about a possible break-in attempt and maybe a > > succeeding one :-( > > > > Any idea about what these messages mean ? > > > > Fred > > -- > > Ce serait beau, l'honnetet=E9 d'un avocat qui demanderait la > > condamnation de son client ! > > -+- Jules Renard -+- > > _______________________________________________ > > freebsd-questions@freebsd.org mailing list > > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > > To unsubscribe, send any mail to " > > freebsd-questions-unsubscribe@freebsd.org" > > --=20 Voici nos mythes, nos erreurs que nous e=FBmes tant de peine =E0 dresser contre les pr=E9c=E9dentes ! ... Tout n'est pas faux dans ce qui fut abandonn=E9. Tout n'est pas vrai dans ce qui se r=E9v=E8le. -+- Paul Val=E9ry -+-
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20101017131646.514aea0f>