Forum Discussion

Pandiarajan_701's avatar
Pandiarajan_701
Icon for Nimbostratus rankNimbostratus
Aug 30, 2011

Syslog Message

Aug 30 03:43:19 local/bigip1 alert sshd[16707]: pam_unix(sshd:auth): check pass; user unknown. Could someone explain what is this Log message is all about ??
management
monitoring
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Aug 30, 2011
    Hi,

     

     

    There should be a second log line from pamd just after that one which lists the username and remote host that someone unsuccessfully attempted to authenticate via SSH with:

     

     

    Jun 24 20:57:14 bigip1 sshd(pam_unix)[10879]: check pass; user unknown

     

    Jun 24 20:57:14 bigip1 sshd(pam_unix)[10879]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4

     

     

    You can check SOL11719 for steps to take to mitigate brute force SSH attacks:

     

     

    sol11719: Mitigating risk from SSH brute force login attacks

     

    https://support.f5.com/kb/en-us/solutions/public/11000/700/sol11719.html

     

     

    Aaron