Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Here are some lines from logwatch:

pam_unix

sshd:   Authentication Failures:
     root (211.167.103.115): 5 Time(s)
     unknown (219.239.110.139): 1 Time(s)   Invalid Users:
     Unknown Account: 1 Time(s) 

su:   Sessions Opened:
     root -> nobody: 3 Time(s)

Now, taken alone I would assume that the su entries are just some timed escalation of privileges (or descalation, as the case may be), but in conjunction with the standard attempts at root password cracking, they're more unsettling. Should I be concerned about security holes due to either of these sets of notice/logwatch entries?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

You should not be concerned about "authentication failures" for root - there are myriads of malware and scriptkiddies tools trying root passwords on every host they can reach. As long as you do not allow direct root logins and / or have a sufficiently complex non-dictionary root password, this is nothing to worry about.

The root -> nobody sessions are indeed dropped priveleges - something that starts as root and changes the security context to the unpriveleged "nobody" user - which is good security practice.

share|improve this answer
    
Ok, just wanted to make sure. Just a little bit of a follow up question, even in the cases where root login is disabled (my intent and the way that I have configured ssh, as well as denyhost), do those authentication failure messages still occur? –  Kzqai May 20 '11 at 15:59
    
OpenSSHd just logs an "invalid user root" login attempt, not an "authentication failure" as it does with an incorrect password –  the-wabbit May 20 '11 at 16:03
    
root -> nobody comes from crons. –  Lekensteyn May 20 '11 at 16:21
    
Hmmm, okay, so that may be indicative of the configuration still allowing attempts on the root account's password, good to know. –  Kzqai May 20 '11 at 19:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.