ssh 'attack'

[Roger Oberholtzer]

On Fri, 2004-08-27 at 17:07, Ken Moffat wrote:
> Roger Oberholtzer wrote:
> 
> >Following up my earlier question about odd (and failed) attempts to log
> >in as various users via ssh, I now see that the attacking systems have
> >added 'root' to the users they are trying. Anyone else notice this?
> >
> >  
> >
> 
> What log are these showing up it? (so I can check)

On Caldera it is in /var/log/messages. I get this mailed to me each
night for review in the morning.



+????????????????????????????+???????????????????????????????+
? Roger Oberholtzer          ?   E-mail: roger at opq.se        ?
? OPQ Systems AB             ?      WWW: http://www.opq.se/  ?
? Nybrogatan 66 nb           ?    Phone: Int + 46 8   314223 ?
? 114 41 Stockholm           ?   Mobile: Int + 46 733 621657 ?
? Sweden                     ?      Fax: Int + 46 8   314223 ?
+????????????????????????????+???????????????????????????????+