################### Logwatch 7.3.6 (05/19/07) #################### Processing Initiated: Wed Apr 7 14:58:46 2010 Date Range Processed: today ( 2010-Apr-07 ) Period is day. Detail Level of Output: 5 Type of Output: unformatted Logfiles for Host: feisty ################################################################## --------------------- Cron Begin ------------------------ Commands Run: User root: cd / && run-parts --report /etc/cron.hourly: 15 Time(s) [ -x /usr/lib/php5/maxlifetime ] && [ -d /var/lib/php5 ] && find /var/lib/php5/ -type f -cmin +$(/usr/lib/php5/maxlifetime) -print0 | xargs -r -0 rm: 30 Time(s) test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ): 1 Time(s) User smmsp: test -x /etc/init.d/sendmail && /usr/share/sendmail/sendmail cron-msp: 45 Time(s) ---------------------- Cron End ------------------------- --------------------- Dovecot Begin ------------------------ Dovecot disconnects: no reason: 4 Time(s) ---------------------- Dovecot End ------------------------- --------------------- dpkg status changes Begin ------------------------ Installed: logwatch 7.3.6-1ubuntu1 tripwire 2.3.1.2.0-11 Unknown lines: 2010-04-07 01:35:11 startup archives unpack 2010-04-07 01:35:13 configure logwatch 7.3.6-1ubuntu1 7.3.6-1ubuntu1 2010-04-07 01:35:13 startup packages configure 2010-04-07 08:49:02 startup archives unpack 2010-04-07 08:49:04 configure tripwire 2.3.1.2.0-11 2.3.1.2.0-11 2010-04-07 08:49:04 startup packages configure ---------------------- dpkg status changes End ------------------------- --------------------- httpd Begin ------------------------ 1.16 MB transferred in 3444 responses (1xx 0, 2xx 326, 3xx 3101, 4xx 17, 5xx 0) 935 Images (0.01 MB), 2503 Content pages (1.14 MB), 1 Redirects (0.00 MB), 5 Other (0.00 MB) Requests with error response codes 404 Not Found /RC/README: 1 Time(s) /README: 1 Time(s) /RoundCube/README: 1 Time(s) /WebMail/README: 1 Time(s) /cube/README: 1 Time(s) /email/README: 1 Time(s) /favicon.ico: 1 Time(s) /htdocs/ossec-wui-0.3/: 1 Time(s) /login/README: 1 Time(s) /mail/README: 1 Time(s) /rc/README: 1 Time(s) /rcube/README: 1 Time(s) /round/README: 1 Time(s) /roundcube/README: 1 Time(s) /webmail/README: 1 Time(s) http://proxyjudge1.proxyfire.net/fastenv: 2 Time(s) ---------------------- httpd End ------------------------- --------------------- Kernel Begin ------------------------ WARNING: Segmentation Faults in these executables [89448.058673] console-kit-dae : 1 Time(s) 1 Time(s): [89504.878668] device eth0 left promiscuous mode 1 Time(s): [89504.878706] audit(1270639962.966:77): dev=eth0 prom=0 old_prom=256 auid=4294967295 1 Time(s): [89506.477910] device eth0 entered promiscuous mode 1 Time(s): [89506.477945] audit(1270639964.976:78): dev=eth0 prom=256 old_prom=0 auid=4294967295 1 Time(s): [89506.480108] device eth0 left promiscuous mode 1 Time(s): [89506.480144] audit(1270639965.006:79): dev=eth0 prom=0 old_prom=256 auid=4294967295 1 Time(s): [89506.485387] device eth0 entered promiscuous mode 1 Time(s): [89506.485427] audit(1270639965.036:80): dev=eth0 prom=256 old_prom=0 auid=4294967295 ---------------------- Kernel End ------------------------- --------------------- pam_unix Begin ------------------------ cron: Sessions Opened: root: 46 Time(s) smmsp: 45 Time(s) passwd: Password changed: lim: 1 Time(s) samba: Sessions Opened: danny: 2 Time(s) sshd: Authentication Failures: root (74.3.231.147): 217 Time(s) unknown (74.3.231.147): 19 Time(s) mysql (74.3.231.147): 2 Time(s) Invalid Users: Unknown Account: 19 Time(s) Sessions Opened: danny: 3 Time(s) su: Sessions Opened: root -> lim: 2 Time(s) root -> root: 1 Time(s) sudo: Authentication Failures: danny(0) -> lim: 3 Time(s) Sessions Opened: root -> root: 51 Time(s) Unknown Entries: auth could not identify password for [lim]: 2 Time(s) conversation failed: 2 Time(s) ---------------------- pam_unix End ------------------------- --------------------- Postfix Begin ------------------------ ****** Summary ************************************************************************************* 50 Miscellaneous warnings ****** Detailed ************************************************************************************ 50 Miscellaneous warnings ------------------------------------------------------------------ 50 unable to look up public/pickup: No such file or directory ---------------------- Postfix End ------------------------- --------------------- samba Begin ------------------------ Opened Sessions: Service public as user: danny from host: quadmire (192.168.1.119) : 1 Time(s) quadmire (192.168.1.133) : 1 Time(s) ---------------------- samba End ------------------------- --------------------- Connections (secure-log) Begin ------------------------ **Unmatched Entries** su: pam_smbpass(su:auth): unrecognized option [missingok]: 1 Time(s) ---------------------- Connections (secure-log) End ------------------------- --------------------- SSHD Begin ------------------------ Failed logins from: 74.3.231.147 (74.3.231.147.reverse.gogrid.com): 219 times root/password: 217 times mysql/password: 2 times Illegal users from: 74.3.231.147 (74.3.231.147.reverse.gogrid.com): 19 times oracle/password: 7 times test/password: 6 times user1/password: 2 times cvsuser/password: 1 time ftpuser/password: 1 time mythtv/password: 1 time test1/password: 1 time Users logging in through sshd: danny: 192.168.1.1 (DD-WRT): 1 time 192.168.1.119 (quadmire): 1 time 192.168.1.148 (eee): 1 time **Unmatched Entries** reverse mapping checking getaddrinfo for quadmire [192.168.1.119] failed - POSSIBLE BREAK-IN ATTEMPT! : 1 time(s) reverse mapping checking getaddrinfo for dd-wrt [192.168.1.1] failed - POSSIBLE BREAK-IN ATTEMPT! : 1 time(s) reverse mapping checking getaddrinfo for 74.3.231.147.reverse.gogrid.com [74.3.231.147] failed - POSSIBLE BREAK-IN ATTEMPT! : 238 time(s) reverse mapping checking getaddrinfo for eee [192.168.1.148] failed - POSSIBLE BREAK-IN ATTEMPT! : 1 time(s) pam_smbpass(sshd:auth): unrecognized option [missingok] : 3 time(s) ---------------------- SSHD End ------------------------- --------------------- Sudo (secure-log) Begin ------------------------ ============================================================================== danny => root ------------- /bin/cp - 2 Times. /bin/mkdir - 3 Times. /bin/mv - 3 Times. /bin/rm - 5 Times. /usr/bin/apt-get - 3 Times. /usr/bin/nano - 5 Times. /usr/sbin/tripwire - 16 Times. /usr/sbin/twadmin - 7 Times. /usr/sbin/twprint - 2 Times. ============================================================================== lim => root ----------- /bin/su - 2 Times. /usr/bin/apt-get - 2 Times. ============================================================================== root => root ------------ /bin/mv - 2 Times. /usr/bin/nmap - 2 Times. /usr/sbin/tripwire - 1 Times. **Unmatched Entries** pam_unix(sudo:session): session opened for user root by danny(uid=0): 51 Time(s) pam_unix(sudo:session): session closed for user root: 51 Time(s) pam_smbpass(sudo:auth): unrecognized option [missingok]: 5 Time(s) pam_unix(sudo:auth): authentication failure; logname=danny uid=0 euid=0 tty=/dev/pts/1 ruser= rhost= user=lim: 3 Time(s) pam_unix(sudo:auth): auth could not identify password for [lim]: 2 Time(s) pam_unix(sudo:auth): conversation failed: 2 Time(s) ---------------------- Sudo (secure-log) End ------------------------- --------------------- Disk Space Begin ------------------------ Filesystem Size Used Avail Use% Mounted on /dev/sda1 36G 20G 15G 59% / ---------------------- Disk Space End ------------------------- ###################### Logwatch End #########################