Re: [suse-security] What does this line mean?

Matthias Pigulla wrote...

I came across several lines in /var/log/warn that look like: "[timestamp] [hostname] login[26456]: ILLEGAL ROOT LOGIN on 'ttyp[n]' from '[hostname]'" I wonder what this message does mean?

It means that someone has been trying to login to your machine over the network as the user root, from [hostname]. The ttyp[n] terminals are network ones, while tty[1-6] are local logins, at the console. josh