Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
root@host [/var/log]# tail -f secure
Jan  3 20:16:10 host sshd[22670]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.142.131.120  user=root
Jan  3 20:16:12 host sshd[22670]: Failed password for root from 61.142.131.120 port 9303 ssh2
Jan  3 20:16:15 host sshd[22670]: Failed password for root from 61.142.131.120 port 9303 ssh2
Jan  3 20:16:18 host sshd[22670]: Failed password for root from 61.142.131.120 port 9303 ssh2
Jan  3 20:16:18 host sshd[22684]: Disconnecting: Too many authentication failures for root
Jan  3 20:16:18 host sshd[22670]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.142.131.120  user=root
Jan  3 20:16:26 host sshd[23127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.142.131.120  user=root
Jan  3 20:16:28 host sshd[23127]: Failed password for root from 61.142.131.120 port 33913 ssh2
Jan  3 20:16:29 host sshd[23127]: Failed password for root from 61.142.131.120 port 33913 ssh2
Jan  3 20:16:30 host sshd[23154]: Connection closed by 61.142.131.120

61.142.131.120 is NOT my IP. So I do not know who that guy is. Moreover I can't login as root. I was lucky that I managed to logged in once. Now, even after I passwd to change password I still can't login to either whm or root.

Notice report of failed password in secure keeps coming even though I simply do not try to login anymore.

Finally things work again but with strange log

Jan  3 20:21:51 host sshd[1252]: reverse mapping checking getaddrinfo for fm-dyn-139-193-157-62.fast.net.id [139.193.157.62] failed - POSSIBLE BREAK-IN ATTEMPT!
Jan  3 20:21:55 host sshd[1252]: Accepted password for root from 139.193.157.62 port 29144 ssh2
Jan  3 20:21:55 host sshd[1252]: pam_unix(sshd:session): session opened for user root by (uid=0)

What does it mean by getaddrinfo doesn't work?

share|improve this question
2  
You shouldn't be allowing ssh login as root unless absolutely necessary. If you do allow login as root, change it to be without-password (requiring an ssh key to login). Otherwise, you open yourself up to people trying to bruteforce the password. –  cpast Jan 4 '13 at 4:35

2 Answers 2

up vote 2 down vote accepted

getaddrinfo is most likely referring to a check sshd does. When you try to ssh into a system, it runs a reverse DNS lookup on your IP address to see if it matches who you say you are. Essentially, it's an attempt to prevent spoofing.

These logs do look like some sort of attack. It's not necessarily targeted; people do try to just randomly break into systems with automated tools. You should never allow password root logins over ssh for exactly this reason. Really, PermitRootLogin in sshd_config should be set to no. If you absolutely must login to root over ssh (which is almost never the case; sometimes, you need it for a program to control your computer remotely, but you normally don't), set up SSH keys on your personal machine, and put the public key in /root/.ssh/authorized_keys on the remote machine. Turn off password root logins by changing PermitRootLogin to without-password in sshd_config. Again, though, it should probably be set to no.

More info on these sorts of attacks: “POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?

share|improve this answer

This...

Jan  3 20:21:51 host sshd[1252]: reverse mapping checking getaddrinfo for fm-dyn-139-193-157-62.fast.net.id [139.193.157.62] failed - POSSIBLE BREAK-IN ATTEMPT! 

...looks like it refers to this

On a side note, you really should disallow root login. If you don't have root access to your machine, you should think about saving all of your files to a usb or something and reinstalling your distro of choice; it's better to be on the safe side and not take chances.

share|improve this answer
    
That guy is me. Obviously the password work though I am not sure what ssh is bitching about. –  Jim Thio Jan 4 '13 at 6:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.