From owner-freebsd-questions  Tue Dec  9 11:32:54 1997
Return-Path: <owner-freebsd-questions>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id LAA26420
          for questions-outgoing; Tue, 9 Dec 1997 11:32:54 -0800 (PST)
          (envelope-from owner-freebsd-questions)
Received: from gdi.uoregon.edu (gdi.uoregon.edu [128.223.170.30])
          by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id LAA26413
          for <freebsd-questions@FreeBSD.ORG>; Tue, 9 Dec 1997 11:32:50 -0800 (PST)
          (envelope-from dwhite@gdi.uoregon.edu)
Received: from localhost (dwhite@localhost)
          by gdi.uoregon.edu (8.8.7/8.8.8) with SMTP id LAA18169;
          Tue, 9 Dec 1997 11:32:36 -0800 (PST)
          (envelope-from dwhite@gdi.uoregon.edu)
Date: Tue, 9 Dec 1997 11:32:35 -0800 (PST)
From: Doug White <dwhite@gdi.uoregon.edu>
Reply-To: Doug White <dwhite@resnet.uoregon.edu>
To: Andrew <perrya@python.shoal.net.au>
cc: freebsd-questions@FreeBSD.ORG
Subject: Re: AUDIT message running X windows
In-Reply-To: <Pine.BSI.3.95.971209212741.15486A-100000@python.shoal.net.au>
Message-ID: <Pine.BSF.3.96.971209113136.18119F-100000@gdi.uoregon.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-questions@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

On Tue, 9 Dec 1997, Andrew wrote:

> G'day all,
> 
> I saw this message on my virtual terminal running X and was wondering what
> it meant:
> 
> AUDIT: Fri Dec 5 21:16:33 1997: 6313 X: client 14 rejected from IP
> 203.26.44.5 port 30212
> 
> 
> The IP address is the IP of my provider. He also provides shell accounts.

My initial guess would be someone at 203.26.44.5 tried to run an X app on
your server and they didn't have the necessary authentication to do so.
Did you try to run an X app on the ISP's box?  

Doug White                              | University of Oregon  
Internet:  dwhite@resnet.uoregon.edu    | Residence Networking Assistant
http://gladstone.uoregon.edu/~dwhite    | Computer Science Major