I just talked to Ti in person about this. This machine is clearly owned and needs to be pulled off net ASAP. -- Craig On Oct 26, 2011, at 8:41 AM, Ti Leggett wrote:
Anyone know who owns this machine and why they were trying to ssh in as root to con?
Oct 24 18:00:43 con sshd[4148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=camisaroja.ci.uchicago.edu user=root Oct 24 18:00:45 con sshd[4148]: Failed password for root from 128.135.250.37 port 50460 ssh2 Oct 24 18:01:20 con sshd[4149]: Connection closed by 128.135.250.37 Oct 24 18:03:57 con sshd[4161]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=camisaroja.ci.uchicago.edu user=root Oct 24 18:04:00 con sshd[4161]: Failed password for root from 128.135.250.37 port 50512 ssh2 Oct 24 18:04:04 con sshd[4161]: Failed password for root from 128.135.250.37 port 50512 ssh2 Oct 24 18:04:07 con sshd[4162]: Connection closed by 128.135.250.37 Oct 24 18:04:07 con sshd[4161]: PAM 1 more authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=camisaroja.ci.uchicago.edu user=root Oct 24 18:04:12 con sshd[4165]: Connection closed by 128.135.250.37
On Oct 26, 2011, at 8:35 AM, DenyHosts wrote:
Added the following hosts to /etc/hosts.blocked:
128.135.250.37 (camisaroja.ci.uchicago.edu)
----------------------------------------------------------------------