SGI: Security

ssh and log messages

Spidy
From Melbourne, Australia
Who joined Jan. 25, 2003, 10:17 p.m.

Wrote the following at Dec. 16, 2006, 3:33 p.m...

Hi all.

I've set up ssh in exactly the same manner on an O2 and an Octane.

The O2 is fine, however the Octanes syslog has the following:

Dec 17 00:51:29 6E:ANUBIS sshd[4812]: Failed password for invalid user webadmin from
211.196.11.148 port 4339 ssh2
Dec 17 00:51:35 6E:ANUBIS sshd[4815]: Invalid user ftp from 211.196.11.148
Dec 17 00:51:35 3E:ANUBIS sshd[4815]: error: Could not get shadow information for NOU
SER
Dec 17 00:51:35 6E:ANUBIS sshd[4815]: Failed password for invalid user ftp from 211.1
96.11.148 port 4385 ssh2
Dec 17 00:51:38 6E:ANUBIS sshd[4819]: Invalid user ftpuser from 211.196.11.148
Dec 17 00:51:38 3E:ANUBIS sshd[4819]: error: Could not get shadow information for NOU
SER
Dec 17 00:51:38 6E:ANUBIS sshd[4819]: Failed password for invalid user ftpuser from 2
11.196.11.148 port 4492 ssh2
Dec 17 00:51:40 6E:ANUBIS sshd[4821]: Invalid user testuser from 211.196.11.148
Dec 17 00:51:40 3E:ANUBIS sshd[4821]: error: Could not get shadow information for NOU
SER
Dec 17 00:51:40 6E:ANUBIS sshd[4821]: Failed password for invalid user testuser from
211.196.11.148 port 4529 ssh2
Dec 17 00:51:42 6E:ANUBIS sshd[4825]: Invalid user testuser from 211.196.11.148
Dec 17 00:51:42 3E:ANUBIS sshd[4825]: error: Could not get shadow information for NOU
SER
Dec 17 00:51:42 6E:ANUBIS sshd[4825]: Failed password for invalid user testuser from
211.196.11.148 port 4558 ssh2
Dec 17 00:51:45 6E:ANUBIS sshd[4828]: Invalid user test from 211.196.11.148
Dec 17 00:51:45 3E:ANUBIS sshd[4828]: error: Could not get shadow information for NOU
SER
Dec 17 00:51:45 6E:ANUBIS sshd[4828]: Failed password for invalid user test from 211.
196.11.148 port 4592 ssh2
Dec 17 00:51:49 6E:ANUBIS sshd[4830]: Invalid user guestuser from 211.196.11.148
Dec 17 00:51:49 3E:ANUBIS sshd[4830]: error: Could not get shadow information for NOU
SER
Dec 17 00:51:49 6E:ANUBIS sshd[4830]: Failed password for invalid user guestuser from
211.196.11.148 port 4635 ssh2
Dec 17 00:51:52 6E:ANUBIS sshd[4831]: Invalid user test01 from 211.196.11.148
Dec 17 00:51:52 3E:ANUBIS sshd[4831]: error: Could not get shadow information for NOU

There are dozens of these messages.

Can anyone shed some light?

Is this similar to the ftp thing, where people scan for open ports?

Man is the only animal smart enough to build the Empire State Building, and the only one stupid enough to jump off it.

ipaddict
From ::1
Who joined March 14, 2006, 2:14 a.m.

Wrote the following at Dec. 16, 2006, 3:43 p.m...

Spidy wrote: Is this similar to the ftp thing, where people scan for open ports?

Yes, it is the same thing.