From owner-freebsd-questions@FreeBSD.ORG Tue May 29 08:36:46 2007 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 3FA4F16A46D for ; Tue, 29 May 2007 08:36:46 +0000 (UTC) (envelope-from asanjuan@bolsabilbao.es) Received: from correo-1.bolsabilbao.es (correo-1.bolsabilbao.es [212.8.77.215]) by mx1.freebsd.org (Postfix) with ESMTP id BE38713C480 for ; Tue, 29 May 2007 08:36:45 +0000 (UTC) (envelope-from asanjuan@bolsabilbao.es) Received: from correo_6.bolsabilbao.es ([10.33.5.206]) by correo-1.bolsabilbao.es with Microsoft SMTPSVC(6.0.3790.3959); Tue, 29 May 2007 10:25:38 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Date: Tue, 29 May 2007 10:25:00 +0200 Content-class: urn:content-classes:message X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.3959 Message-ID: In-Reply-To: <20070529170113.4142ae21@localhost> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: auto mounting newtork shares Thread-Index: Acehv1VhCV4R+E2dQhaoba9qQXdl7AACY4bw From: "Aitor San Juan" To: Importance: normal Priority: normal X-OriginalArrivalTime: 29 May 2007 08:25:38.0170 (UTC) FILETIME=[EFC85DA0:01C7A1CA] X-ExchangeSecure-AntiSpam: valid(0) Subject: login failures X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 May 2007 08:36:46 -0000 Hi List, Our FreeBSD system has been recently reporting login failures, such as: May 23 16:44:23 lpool login: 2 LOGIN FAILURES FROM host_name_1 May 23 16:44:23 lpool login: 2 LOGIN FAILURES FROM host_name_1, = logon_user_used_1 May 26 15:07:27 lpool login: 1 LOGIN FAILURE ON ttyv1 May 26 15:07:27 lpool login: 1 LOGIN FAILURE ON ttyv1, root May 26 15:07:34 lpool login: 1 LOGIN FAILURE ON ttyv1 May 26 15:07:34 lpool login: 1 LOGIN FAILURE ON ttyv1, logon_name_used_2 May 26 15:21:50 lpool login: 1 LOGIN FAILURE ON ttyv0 May 26 15:21:50 lpool login: 1 LOGIN FAILURE ON ttyv0, = ^[[B^[[A^[[A^[[A^[[A^[[A^[[A^[[A^[[A^[[A^[[A^[[A^[[A^[[A^[[A^[[A^[[ I wonder where in the system, in more detail, this is registered. Can I = assure that those TTYs refer to logon attemps from the physical console? Is = there anyway to track down more information. In addition to this, how could we = enable system activity logging? Any hint would be highly appreciated. Please, point me to any good = documentation on FreeBSD security (concepts and planning guide). Thanks in advance. Aitor. ************ LEGEZKO OHARRA / AVISO LEGAL / LEGAL ADVICE *************=20 Mezu honek isilpeko informazioa gorde dezake, edo jabea duena, edota = legez babestuta dagoena. Zuri zuzendua ez bada, bidali duenari esan eta = ezabatu, inori berbidali edo gorde gabe, legeak debekatzen duelako = mezuak erabiltzea baimenik gabe.=20 -------------------------------------------------------------------------= - Este mensaje puede contener informaci=F3n confidencial, en propiedad o = legalmente protegida. Si usted no es el destinatario, le rogamos lo = comunique al remitente y proceda a borrarlo, sin reenviarlo ni = conservarlo, ya que su uso no autorizado est=E1 prohibido legalmente. -------------------------------------------------------------------------= - This message may contain confidential, proprietary or legally privileged = information. If you are not the intended recipient of this message, = please notify it to the sender and delete without resending or backing = it, as it is legally prohibited. *************************************************************************= *