I'm setting up a small VPS (last Centos) and I'm facing a problem with my SSHD logs. I want to install fail2ban and everything seems to run fine, but I noticed a lot of attempts of bruteforce in the secure log, and nothing seems to be jailed. By investigating further I noticed that a lot of these attempts happens to be logged in the future. I guess that could be the problem for fail2ban.
Is anybody have an idea why my SSHD would log events in the future ? Thanks.
Here is an example of what I said :
[root@myhost log]# date Mon Nov 1 11:44:57 EDT 2010
--- content of /var/log/secure
Nov 1 09:01:21 myhost sshd: pam_unix(sshd:auth): check pass; user unknown Nov 1 09:01:21 myhost sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.XX.XX.XX Nov 1 09:01:23 myhost sshd: Failed password for invalid user smecher from 221.XX.XX.XX port 22502 ssh2 Nov 1 13:01:23 myhost sshd: Received disconnect from 221.XX.XX.XX: 11: Bye Bye Nov 1 13:01:33 myhost sshd: Connection closed by 221.XX.XX.XX Nov 1 09:03:01 myhost crond: pam_loginuid(crond:session): set_loginuid failed opening loginuid Nov 1 09:18:01 myhost crond: pam_loginuid(crond:session): set_loginuid failed opening loginuid
As you can see, the attempts coming from 221.XX.XX.XX are in the future. I really wonder why.