SSHD logs events in the future

Question

I'm setting up a small VPS (last Centos) and I'm facing a problem with my SSHD logs. I want to install fail2ban and everything seems to run fine, but I noticed a lot of attempts of bruteforce in the secure log, and nothing seems to be jailed. By investigating further I noticed that a lot of these attempts happens to be logged in the future. I guess that could be the problem for fail2ban.

Is anybody have an idea why my SSHD would log events in the future ? Thanks.

Here is an example of what I said :

[root@myhost log]# date
Mon Nov  1 11:44:57 EDT 2010

--- content of /var/log/secure

Nov  1 09:01:21 myhost sshd[5381]: pam_unix(sshd:auth): check pass; user unknown
Nov  1 09:01:21 myhost sshd[5381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.XX.XX.XX
Nov  1 09:01:23 myhost sshd[5381]: Failed password for invalid user smecher from 221.XX.XX.XX port 22502 ssh2
Nov  1 13:01:23 myhost sshd[5384]: Received disconnect from 221.XX.XX.XX: 11: Bye Bye
Nov  1 13:01:33 myhost sshd[5409]: Connection closed by 221.XX.XX.XX
Nov  1 09:03:01 myhost crond[7335]: pam_loginuid(crond:session): set_loginuid failed opening loginuid
Nov  1 09:18:01 myhost crond[30300]: pam_loginuid(crond:session): set_loginuid failed opening loginuid

As you can see, the attempts coming from 221.XX.XX.XX are in the future. I really wonder why.

Answer 1

Perhaps the sshd process is inheriting a TZ environment variable from somewhere that is causing it to misreport the time.

It is also possible that there is something wrong in your provider's VPS setup. The technology your provider may be using to provide you a virtual server might not be correctly emulating or virtualizing the RTC. I ran in to this problem using QEMU; sometimes the virtualized RTC and the hosts' real RTC would get out of sync.

Answer 2

It looks like you are seeing this bug. What version of CentOS exactly are you running, and do you have all of the latest patches?