Date: Mon, 04 Feb 2002 11:01:24 -0800 From: Victor Grey <victor@customdynamic.net> To: <freebsd-questions@freebsd.org> Subject: Is this evidence of a break in on my server? Message-ID: <B8841A84.70C6%victor@customdynamic.net>
next in thread | raw e-mail | index | archive | help
I have a server co-located at a (supposedly) secure data center, running Fbsd 4.4 release. According to /var/log/messages it rebooted itself at one minute before midnight last night, and then (I think that's what the lines in messages mean) discovered a mouse attached. Then at 43 minutes past midnight there were six login failures. (Running tripwire this morning showed nothing suspicious.) Well - there shouldn't be any mouse attached, it's a headless server. Furthermore, if I understand it correctly, a login failure at ttyv0 means at a local terminal -- not a remote break-in attempt. The data center swears there was no one in there last night. Can someone verify for me that I am interpreting the log correctly before I start accusing the data center people? Or any other insights/things I should look at? Here are the relevant lines from /var/log/messages: ----------------------------- Feb 3 23:59:00 p2 /kernel: psm0: <PS/2 Mouse> irq 12 on atkbdc0 Feb 3 23:59:00 p2 /kernel: psm0: model Generic PS/2 mouse, device ID 0 Feb 4 00:43:38 p2 login: 3 LOGIN FAILURES ON ttyv0 Feb 4 00:43:38 p2 login: 3 LOGIN FAILURES ON ttyv0, root ----------------------------- Thanks, Victor Grey To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?B8841A84.70C6%victor>