Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just typed a wrong password for login to ssh @ root.

I went to

/var/log/faillog

But the file is empty ( tho its filesize is: 32 Byte )

Ok in auth.log is spammed this:

reverse mapping checking getaddrinfo for dinamic-tigo186-180-143-166.tigo.com.co [186.180.143.166] failed - POSSIBLE BREAK-IN ATTEMPT!
Feb 21 03:44:22 ns3xxxx9 sshd[7497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.180.143.166  user=root

What's that?

share|improve this question
add comment

2 Answers

up vote 8 down vote accepted

You can (by default) check for these failures in /var/log/auth.log

share|improve this answer
    
thanks +1, Do you know what those log lines mean? (watch first post adds) –  dynamic Feb 21 '11 at 12:02
    
The getaddrinfo error just means that something was strange with the DNS records for that IP/hostname. Not a serious error, really. The second line is where they fail to login as root. –  signine Mar 1 '11 at 18:59
add comment

The first line means that a connection attempt was received from an IP address. The ssh server attemped to reverse-resolve the address and got a hostname (dinamic-tigo186-180-143-166.tigo.com.co), but when it attempted to forward-resolve that hostname to get back to the original IP address, it failed. This isn't fatal, it usually means someone else has screwed up their DNS, but ssh lets you know that that log entry has failed a basic can-I-be-relied-on test.

The second line means someone from the same IP address tried to ssh in as root, and failed.

If you get too many of the second kind of entry and want to make things harder for people, I wrote a piece on techniques for dealing with automated ssh password guessing that may interest you, though it doesn't cover fail2ban and similar technologies (because I don't like them).

share|improve this answer
    
thanks +1. But Is that possible that Linux doenst' support automated "block" login if someone makes x fail attempts? I don't want to install fail2ban! –  dynamic Feb 21 '11 at 12:20
    
OpenSSH (not "Linux", the kernel isn't responsible for this) will not automatically block logins from a given address after a certain number of failures. There do exist rate-limiting configuration variables you can use inside sshd's config file (man sshd_config), or you can use fail2ban, or you can use one of the ideas in my tech note. The joy of free software is that the power and the responsibility are both yours: go for it. –  MadHatter Feb 21 '11 at 12:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.