Date: Fri, 18 May 2007 13:35:32 -0500 From: "Gerald Waugh" <gwaugh (at mark) frontstreetnetworks.com> Subject: [coba-e:09895] Re: Is this a attack! "check pass; user unknown" To: <coba-e (at mark) bluequartz.org> Message-Id: <001901c7997b$543b7b80$0601a8c0@systemax> In-Reply-To: <07d401c79975$d9742780$8c5c7680$@com> X-Mail-Count: 09895Tunc, Please consider posting in plain text I would change the SSH port to something other than port 22 - Gerald Waugh http://frontstreetnetworks.com <http://frontstreetnetworks.com/> Front Street Networks 4604 Fern Ave Shreveport, LA 71105-3118 V: 318-862-3575/3577 F: 318-862-3576 -----Original Message----- From: TUNC ERESEN [mailto:tunc (at mark) eresen.com] Sent: Friday, May 18, 2007 12:56 PM To: coba-e (at mark) bluequartz.org Subject: [coba-e:09892] Is this a attack! "check pass; user unknown" Hi all May 18 18:42:30 ns3 PAM_pwdb[11102]: check pass; user unknown May 18 18:42:30 ns3 PAM_pwdb[11081]: check pass; user unknown May 18 18:42:30 ns3 PAM_pwdb[11082]: check pass; user unknown May 18 18:42:30 ns3 PAM_pwdb[11100]: check pass; user unknown May 18 18:42:30 ns3 PAM_pwdb[11120]: check pass; user unknown May 18 18:42:30 ns3 PAM_pwdb[11121]: check pass; user unknown May 18 18:42:30 ns3 PAM_pwdb[11122]: check pass; user unknown May 18 18:42:30 ns3 PAM_pwdb[11103]: check pass; user unknown May 18 18:42:30 ns3 PAM_pwdb[11105]: check pass; user unknown May 18 18:42:30 ns3 PAM_pwdb[11101]: check pass; user unknown May 18 18:42:30 ns3 PAM_pwdb[11104]: check pass; user unknown May 18 18:42:30 ns3 PAM_pwdb[11124]: check pass; user unknown May 18 18:42:30 ns3 PAM_pwdb[11106]: check pass; user unknown May 18 18:42:30 ns3 PAM_pwdb[11126]: check pass; user unknown Hot of the log.. And What to do about it ? Girrr again. I am getting 10000's of these how can I kill or stop it. Or is it in a loop. Regards Tunc -- This message has been scanned for viruses and dangerous content by <http://www.mailscanner.info/> MailScanner, and is believed to be clean. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.9895_2.html (attatchment)(tag is disabled)