What does this line mean?
Hi folks, I came across several lines in /var/log/warn that look like: "[timestamp] [hostname] login[26456]: ILLEGAL ROOT LOGIN on 'ttyp[n]' from '[hostname]'" I wonder what this message does mean? Thanks a lot, Matthias -- w e b f a c t o r y Matthias Pigulla <mp@webfactory.de> - Geschaefsfuehrer Lessingstr. 60 - 53113 Bonn - http://www.webfactory.de/ Fon: 0228-9114455 - Fax: 0228-9114499 - ICQ: 49185492
Matthias Pigulla wrote...
I came across several lines in /var/log/warn that look like: "[timestamp] [hostname] login[26456]: ILLEGAL ROOT LOGIN on 'ttyp[n]' from '[hostname]'" I wonder what this message does mean?
It means that someone has been trying to login to your machine over the network as the user root, from [hostname]. The ttyp[n] terminals are network ones, while tty[1-6] are local logins, at the console. josh
That means somone attemped to log in as root from somewhere other than the console, or wherever you allow root logins. (Most likely somone telnet'd to your box and tried to login as root) Scott ----- Original Message ----- From: Matthias Pigulla <mp@webfactory.de> To: <suse-security@suse.com> Sent: Thursday, September 16, 1999 2:20 PM Subject: [suse-security] What does this line mean?
Hi folks,
I came across several lines in /var/log/warn that look like: "[timestamp] [hostname] login[26456]: ILLEGAL ROOT LOGIN on 'ttyp[n]' from '[hostname]'"
I wonder what this message does mean?
Thanks a lot, Matthias --
w e b f a c t o r y Matthias Pigulla <mp@webfactory.de> - Geschaefsfuehrer Lessingstr. 60 - 53113 Bonn - http://www.webfactory.de/ Fon: 0228-9114455 - Fax: 0228-9114499 - ICQ: 49185492
-- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
participants (3)
-
josh -
Matthias Pigulla -
scott