cancel
Showing results for 
Search instead for 
Did you mean: 

Athorication faild massages

Chandrahasa s
Valued Contributor

Athorication faild massages

We have two servers 168.1 and 168.2
My 168.2 root account is getting locked regularly.
When iam going through syslog of 168.2 i am getting messages authorication for root from 168.1 failed.
Can any suggest how can find which application or process contacting 168.2 in 168.1
and is there any way find list of login request from 168.1 to other server.
6 REPLIES
Dennis Handly
Acclaimed Contributor

Re: Athorication faild massages

If you use "lastb -R" you can get the source machine.
Michal Kapalka (mikap)
Honored Contributor

Re: Athorication faild massages

hi,

follow the advice from Dennis, and also you could check the connections with the Network Admins.

mikap
Chandrahasa s
Valued Contributor

Re: Athorication faild massages

Hi all,
Thanks for reply

Here i want to know all login request from 168.1 to other servers.

I want to know which process in 168.1 exactly send this login request.
Johnson Punniyalingam
Honored Contributor

Re: Athorication faild massages

>>Here i want to know all login request from 168.1 to other servers.<<

>>I want to know which process in 168.1 exactly send this login request.<<<

It pretty difficult for all of us to find / what you are looking for , ..? Hence you must be familiar with your server or application set up or some documentation to start digging the problem ..? otherwise we'll be shooting in the dark room .. ;(

check crontab entries ..?
any ftp jobs jobs, I could understand if you have any "password" hard-coded script execution could cause your root account getting locked regularly, either you remove un-sucessfull login counts to "0" for the root account.


have you followed advice from >>Dennis post ..?

# last -R

you can also check under the below file

# cat /var/adm/syslog/syslog.log

# netstat -an |grep -i 168.2.168.1
Problems are common to all, but attitude makes the difference
Dennis Handly
Acclaimed Contributor

Re: Athorication faild massages

>I want to know which process in 168.1 exactly send this login request.

I guess you already know which machine is attacking yours?

You may have to turn on auditing to find who is sending bogus passwords to your machine.
Chandrahasa s
Valued Contributor

Re: Athorication faild massages

Thanks to all.