Root: 1 failure since last login

[Dotan Cohen]

On 10/10/2007, Nils Kassube <kassube at gmx.net> wrote:
> Dotan Cohen wrote:
> > Thanks. There's a lot of root logins. Is that as scary as I think it
> > is? This machine does have sshs running, but it's behind a router with
> > no NAT forwarding.
>
> It looks quite normal. Those entries are mostly cron jobs. And the failure
> was obviously a typo when you tried to login. Compare the time stamps -
> there are only a few seconds from the failure to successful login:
>
> > Oct 10 20:25:17 ubuntu-laptop login[4662]: (pam_unix) authentication
> > failure; logname= uid=0 euid=0 tty=tty4 ruser= rhost=  user=root
> > Oct 10 20:25:19 ubuntu-laptop login[4662]: FAILED LOGIN (1) on 'tty4'
> > FOR `root', Authentication failure
> > Oct 10 20:25:28 ubuntu-laptop login[4662]: (pam_unix) session opened
> > for user root by (uid=0)
> > Oct 10 20:25:28 ubuntu-laptop login[16205]: ROOT LOGIN  on 'tty4'
>
>
> Nils
>

Yes, it would seem so. So, I suppose that the auth.log shows nothing
related to my current problem. When one logs into root and gets the
message "1 failure since last login", what would be a good next step
to take?

Dotan Cohen

http://what-is-what.com
http://gibberish.co.il
א-ב-ג-ד-ה-ו-ז-ח-ט-י-ך-כ-ל-ם-מ-ן-נ-ס-ע-ף-פ-ץ-צ-ק-ר-ש-ת