Athorication faild massages

[Chandrahasa s]

We have two servers 168.1 and 168.2
My 168.2 root account is getting locked regularly.
When iam going through syslog of 168.2 i am getting messages authorication for root from 168.1 failed.
Can any suggest how can find which application or process contacting 168.2 in 168.1
and is there any way find list of login request from 168.1 to other server.

[Dennis Handly]

If you use "lastb -R" you can get the source machine.

[Michal Kapalka (mikap)]

hi,

follow the advice from Dennis, and also you could check the connections with the Network Admins.

mikap

[Chandrahasa s]

Hi all,
Thanks for reply

Here i want to know all login request from 168.1 to other servers.

I want to know which process in 168.1 exactly send this login request.

[Johnson Punniyalingam]

>>Here i want to know all login request from 168.1 to other servers.<<

>>I want to know which process in 168.1 exactly send this login request.<<<

It pretty difficult for all of us to find / what you are looking for , ..? Hence you must be familiar with your server or application set up or some documentation to start digging the problem ..? otherwise we'll be shooting in the dark room .. ;(

check crontab entries ..?
any ftp jobs jobs, I could understand if you have any "password" hard-coded script execution could cause your root account getting locked regularly, either you remove un-sucessfull login counts to "0" for the root account.


have you followed advice from >>Dennis post ..?

# last -R

you can also check under the below file

# cat /var/adm/syslog/syslog.log

# netstat -an |grep -i 168.2.168.1

[Dennis Handly]

>I want to know which process in 168.1 exactly send this login request.

I guess you already know which machine is attacking yours?

You may have to turn on auditing to find who is sending bogus passwords to your machine.

[Chandrahasa s]

Thanks to all.