I have run two commands below. I find some of the accounts attack as below. I do not have the account test,teste,oracle and admin in my home directory. As there system account. How to know which are valid and in-valid accounts.

lastb | awk '{print $1}' | sort | uniq -c | sort -rn | head -5
   5898 root
    196 test
    164 oracle
    154 teste
     86 admin
[root@localhost ~]# awk 'gsub(".*sshd.*Failed password for (invalid user )?", "") {print $1}' /var/log/secure* | sort | uniq -c | sort -rn | head -5
  13835 root
    386 test
    185 oracle
    146 admin
    131 nagios
  • You may want to install fail2ban on that server -- it'll automatically and temporarily block any IP adress that repeatedly attempts to log in with invalid credentials. – Shadur Dec 14 '12 at 7:57
  • @jordanm which is the right method to install fail2ban because I try before with yum it does not work. Beside fail2ban will ossec be a good tool? – newbie14 Dec 14 '12 at 15:05

These are just automated bot attacks and not unusual for any internet exposed system. To get a list of users you can use getent in CentOS:

getent passwd | awk -F':' '{ print $1 }'

To put it together with what you already have:

while read -r count user; do
   printf '%s %s ' "$user" "$count" 
   if getent passwd | grep -q "^$user:"; then
       printf 'valid\n'
       printf 'invalid\n'
done < <(awk 'gsub(".*sshd.*Failed password for (invalid user )?", "") {print $1}' /var/log/secure* | sort | uniq -c | sort -rn | head -5)
  • @ChandraRavoori "unusual", thanks for pointing out the mistake. – jordanm Dec 14 '12 at 6:28
  • I got this results root 13835 valid test 386 invalid oracle 185 invalid admin 146 invalid nagios 131 invalid so mean those invalid are being tried is it? They did not manage to break in the system I guess rite? – newbie14 Dec 14 '12 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.