No standard syncs today This is very alarming to me. From git.mcs.anl.gov's auth logs on syslog.mcs.anl.gov yesterday. May 11 06:35:22 git sshd[3098]: Accepted keyboard-interactive/pam for root from 130.83.204.10 port 11565 ssh2 May 11 06:38:48 git sshd[3400]: Accepted keyboard-interactive/pam for root from 130.83.204.10 port 11567 ssh2 May 11 06:48:07 git sshd[13649]: Failed hostbased for root from 128.135.125.172 port 55219 ssh2 May 11 06:48:11 git sshd[13649]: Failed hostbased for root from 128.135.125.172 port 55219 ssh2 May 11 06:48:11 git sshd[13649]: Accepted keyboard-interactive/pam for root from 128.135.125.172 port 55219 ssh2 MCS sysadmins, we need to gather and investigate this immediately. Meet in the fishbowl when you get this. CI Admins, why am I seeing keyboard interactive attempts from con.ci? Does con.ci log anywhere other than itself? Are there any logs we can investigate that we trust? At this point I'm led to believe that we have owned machines in MCS and CI. I immediately suspect git.mcs.anl.gov, but I also suspect backup.ci.anl.gov based on this: May 11 06:27:21 git sshd[2983]: Connection from 140.221.8.40 port 58489 May 11 06:27:21 git sshd[2983]: Did not receive identification string from 140.221.8.40 == Craig