[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [cobalt-security] Where can I find more about these log reports
- Subject: Re: [cobalt-security] Where can I find more about these log reports
- From: "Dave" <maxdoubt@xxxxxx>
- Date: Tue, 30 Oct 2001 22:19:17 -0500
- List-id: Mailing list for users to address network security on Cobalt products. <cobalt-security.list.cobalt.com>
----- Original Message -----
From: "Render-Vue" <sales@xxxxxxxxxxxxxx>
Sent: Tuesday, October 30, 2001 5:12 PM
Subject: [cobalt-security] Where can I find more about these log reports
> Have logcheck running and the following came up this morning...
>
> Oct 30 14:01:40 ns PAM_pwdb[4984]: check pass; user unknown
>
> The FTP activities are logged also but nothing else in all the logs shown
> any more details where can I find or how can I find out where this user is
> coming from? Could it be somone at the collocation?
When I see this it's usually someone who was trying to gain access to a part
off a web site containing an .htaccess file - maybe like their stats (if your
running webalizer). Like the message says, "user unknown"
Hope this helped a little...
Dave~