Here are some lines from logwatch:
pam_unix sshd: Authentication Failures: root (220.127.116.11): 5 Time(s) unknown (18.104.22.168): 1 Time(s) Invalid Users: Unknown Account: 1 Time(s) su: Sessions Opened: root -> nobody: 3 Time(s)
Now, taken alone I would assume that the
su entries are just some timed escalation of privileges (or descalation, as the case may be), but in conjunction with the standard attempts at root password cracking, they're more unsettling. Should I be concerned about security holes due to either of these sets of notice/logwatch entries?