Curious log entry

[Matthew Carpenter]

If it happens enough, I'd be alerting Charter (lookup charter-ne.com at
www.hexillion.com or the IP address) and requesting action be taken.  I
wouldn't be allowing Postgre activity through the firewall anyway (there
is no excuse to not have a firewall of some sort, since the box can be
it's own firewall in worst case).  SQL traffic should be limited to the
internal network and through VPN tunnels.  


On Sat, 29 Jun 2002 16:21:29 -0700
"Net Llama!" <netllama at linux-sxs.org> wrote:

> Maybe they were port scanning you, and thought that you had postgres 
> running?
> 
> Alan Jackson wrote:
> > No. And I don't know who charter-ne.com is. That's what concerns me.
> > 
> > On Sat, 29 Jun 2002 08:43:42 -0700
> > "Net Llama!" <netllama at linux-sxs.org> wrote:
> > 
> > 
> >>Are you running postgresql?  postgres has several different auth 
> >>mechanisms, most of which requiring user/pass.  Look in postgres.conf 
> >>and pg_hba.conf.
> >>
> >>Alan Jackson wrote:
> >>
> >>>I got several of these in my logfile yesterday - is this innocent
> >>>or is it something I should pursue?
> >>>
> >>>Jun 28 11:18:22 earthman login[13633]: FAILED LOGIN 1 FROM
> >178-64-189-66.wo.cpe.charter-ne.com FOR postgres, Authentication
> >service cannot retrieve authentication info.>>Jun 28 11:18:27 earthman
> >login[13633]: FAILED LOGIN 2 FROM 178-64-189-66.wo.cpe.charter-ne.com
> >FOR postgres, Authentication service cannot retrieve authentication
> >info.>>Jun 28 11:23:07 earthman login[13673]: FAILED LOGIN SESSION FROM
> >178-64-189-66.wo.cpe.charter-ne.com FOR (null), Error in service module
> 
> 
> 
> -- 
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> L. Friedman                       	       netllama at linux-sxs.org
> Linux Step-by-step & TyGeMo: 		    http://netllama.ipfox.com
> 
>    4:20pm  up 71 days, 23:08,  2 users,  load average: 0.00, 0.27, 0.55
> 
> _______________________________________________
> Linux-users mailing list -
> http://linux-sxs.org/mailman/listinfo/linux-users
> Subscribe/Unsubscribe info, Archives,and Digests are located at the
> above URL.