View Single Post
  #2  
Old February 28th, 2006, 07:07 AM
bbloke's Avatar
bbloke bbloke is online now
Registered User
 
Join Date: Jun 2002
Location: UK
Posts: 1,442
Thanks: 0
Thanked 16 Times in 14 Posts
bbloke has a spectacular aura aboutbbloke has a spectacular aura about
I've seen something like that within the logs of an IRIX workstation, and I would guess it was, in my case, an automated attempt to login to the system using common usernames. In your case, assuming your account names are obscure (i.e. not something like "john!"), then it could well be that someone who knows you is trying to get in, unless your usernames and passwords were somehow easy to intercept at another point (eg. not using ssh or sftp, but using unencrypted methods instead).

There are a few things you can do, such as avoid enabling the root account (trying to login as "root" is a fairly reasonable guess if the attempts are indeed automated), don't enable any services unless really necessary, restrict remote logins to certain users, ensure your firewall is on, use NAT and port forwarding if behind a router, and you can deny access to certain IP addresses if you have frequent connection attempts from one location... or... better yet... deny access to all IP addresses except a very, very limited few!
Reply With Quote