Root: 1 failure since last login

Wed Oct 10 18:51:01 UTC 2007

On 10/10/2007, Felipe Figueiredo <philsf79 at gmail.com> wrote:
> On Wednesday 10 October 2007 15:31:43 Dotan Cohen wrote:
> > My Ubuntu machine (Dell Inspiron 6400/ E1505) started running slowly,
> > so I CTRL-ALT-F4'ed into a text console with the intention of running
> > top. I found that even though the login prompt was shown, many errors
> > were filling the screen. I saw something that reminded me of the
> > number of this machine's Intel wireless card (ipw1945 I think), DMA
> > errors, and others. When I logged in as root I got this message: "1
> > failure since last login". What logs can I start checking?
> >
>
> auth.log
>

Thanks. There's a lot of root logins. Is that as scary as I think it
is? This machine does have sshs running, but it's behind a router with
no NAT forwarding.

Oct  8 10:09:22 ubuntu-laptop kdm: :0[5789]: (pam_unix) session closed
for user ubuntu
Oct  8 16:12:25 ubuntu-laptop sshd[5531]: Server listening on :: port 22.
Oct  8 16:14:50 ubuntu-laptop kdm: :0[5856]: (pam_unix) authentication
failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=  user=ubuntu
Oct  8 16:16:11 ubuntu-laptop kdm: :0[5856]: (pam_unix) authentication
failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=  user=ubuntu
Oct  8 16:16:43 ubuntu-laptop kdm: :0[5856]: (pam_unix) session opened
for user ubuntu by (uid=0)
Oct  8 16:17:01 ubuntu-laptop CRON[6099]: (pam_unix) session opened
for user root by (uid=0)
Oct  8 16:17:01 ubuntu-laptop CRON[6099]: (pam_unix) session closed
for user root
Oct  8 17:17:01 ubuntu-laptop CRON[6228]: (pam_unix) session opened
for user root by (uid=0)
Oct  8 17:17:01 ubuntu-laptop CRON[6228]: (pam_unix) session closed
for user root
Oct  8 18:17:01 ubuntu-laptop CRON[6290]: (pam_unix) session opened
for user root by (uid=0)
Oct  8 18:17:01 ubuntu-laptop CRON[6290]: (pam_unix) session closed
for user root
Oct  8 19:17:01 ubuntu-laptop CRON[6366]: (pam_unix) session opened
for user root by (uid=0)
Oct  8 19:17:01 ubuntu-laptop CRON[6366]: (pam_unix) session closed
for user root
Oct  8 20:17:01 ubuntu-laptop CRON[6588]: (pam_unix) session opened
for user root by (uid=0)
Oct  8 20:17:01 ubuntu-laptop CRON[6588]: (pam_unix) session closed
for user root
Oct  8 21:17:01 ubuntu-laptop CRON[6711]: (pam_unix) session opened
for user root by (uid=0)
Oct  8 21:17:01 ubuntu-laptop CRON[6711]: (pam_unix) session closed
for user root
Oct  8 22:17:01 ubuntu-laptop CRON[6761]: (pam_unix) session opened
for user root by (uid=0)
Oct  8 22:17:01 ubuntu-laptop CRON[6761]: (pam_unix) session closed
for user root
Oct  8 23:17:01 ubuntu-laptop CRON[6816]: (pam_unix) session opened
for user root by (uid=0)
Oct  8 23:17:01 ubuntu-laptop CRON[6816]: (pam_unix) session closed
for user root
Oct  9 00:17:01 ubuntu-laptop CRON[6886]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 00:17:01 ubuntu-laptop CRON[6886]: (pam_unix) session closed
for user root
Oct  9 01:17:01 ubuntu-laptop CRON[7140]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 01:17:01 ubuntu-laptop CRON[7140]: (pam_unix) session closed
for user root
Oct  9 02:17:01 ubuntu-laptop CRON[7973]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 02:17:01 ubuntu-laptop CRON[7973]: (pam_unix) session closed
for user root
Oct  9 03:17:01 ubuntu-laptop CRON[8064]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 03:17:01 ubuntu-laptop CRON[8064]: (pam_unix) session closed
for user root
Oct  9 04:17:01 ubuntu-laptop CRON[8133]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 04:17:01 ubuntu-laptop CRON[8133]: (pam_unix) session closed
for user root
Oct  9 05:17:01 ubuntu-laptop CRON[8226]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 05:17:01 ubuntu-laptop CRON[8226]: (pam_unix) session closed
for user root
Oct  9 06:17:01 ubuntu-laptop CRON[8312]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 06:17:01 ubuntu-laptop CRON[8312]: (pam_unix) session closed
for user root
Oct  9 06:25:01 ubuntu-laptop CRON[8320]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 06:25:01 ubuntu-laptop CRON[8320]: (pam_unix) session closed
for user root
Oct  9 07:17:01 ubuntu-laptop CRON[8396]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 07:17:01 ubuntu-laptop CRON[8396]: (pam_unix) session closed
for user root
Oct  9 07:30:01 ubuntu-laptop CRON[8413]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 07:30:01 ubuntu-laptop CRON[8413]: (pam_unix) session closed
for user root
Oct  9 08:17:01 ubuntu-laptop CRON[8683]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 08:17:01 ubuntu-laptop CRON[8683]: (pam_unix) session closed
for user root
Oct  9 09:17:01 ubuntu-laptop CRON[8763]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 09:17:01 ubuntu-laptop CRON[8763]: (pam_unix) session closed
for user root
Oct  9 10:17:01 ubuntu-laptop CRON[9356]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 10:17:01 ubuntu-laptop CRON[9356]: (pam_unix) session closed
for user root
Oct  9 11:17:01 ubuntu-laptop CRON[9527]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 11:17:01 ubuntu-laptop CRON[9527]: (pam_unix) session closed
for user root
Oct  9 12:17:01 ubuntu-laptop CRON[9630]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 12:17:01 ubuntu-laptop CRON[9630]: (pam_unix) session closed
for user root
Oct  9 13:17:01 ubuntu-laptop CRON[9717]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 13:17:01 ubuntu-laptop CRON[9717]: (pam_unix) session closed
for user root
Oct  9 14:17:01 ubuntu-laptop CRON[9807]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 14:17:01 ubuntu-laptop CRON[9807]: (pam_unix) session closed
for user root
Oct  9 15:17:01 ubuntu-laptop CRON[9900]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 15:17:01 ubuntu-laptop CRON[9900]: (pam_unix) session closed
for user root
Oct  9 16:17:01 ubuntu-laptop CRON[9994]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 16:17:01 ubuntu-laptop CRON[9994]: (pam_unix) session closed
for user root
Oct  9 17:17:01 ubuntu-laptop CRON[10081]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 17:17:01 ubuntu-laptop CRON[10081]: (pam_unix) session closed
for user root
Oct  9 18:17:01 ubuntu-laptop CRON[10190]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 18:17:01 ubuntu-laptop CRON[10190]: (pam_unix) session closed
for user root
Oct  9 19:17:01 ubuntu-laptop CRON[10286]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 19:17:01 ubuntu-laptop CRON[10286]: (pam_unix) session closed
for user root
Oct  9 20:17:01 ubuntu-laptop CRON[10386]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 20:17:01 ubuntu-laptop CRON[10386]: (pam_unix) session closed
for user root
Oct  9 21:17:01 ubuntu-laptop CRON[10551]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 21:17:01 ubuntu-laptop CRON[10551]: (pam_unix) session closed
for user root
Oct  9 22:17:01 ubuntu-laptop CRON[10614]: (pam_unix) session opened
for user root by (uid=0)
Oct  9 22:17:01 ubuntu-laptop CRON[10614]: (pam_unix) session closed
for user root
Oct  9 23:01:04 ubuntu-laptop kdm: :0[5856]: (pam_unix) session closed
for user ubuntu
Oct  9 23:01:17 ubuntu-laptop kdm: :0[10825]: (pam_unix) session
opened for user ubuntu by (uid=0)
Oct  9 23:10:06 ubuntu-laptop kdm: :0[10825]: (pam_unix) session
closed for user ubuntu
Oct  9 23:10:22 ubuntu-laptop kdm: :0[11108]: (pam_unix) session
opened for user ubuntu by (uid=0)
Oct 10 08:17:01 ubuntu-laptop CRON[12513]: (pam_unix) session opened
for user root by (uid=0)
Oct 10 08:17:01 ubuntu-laptop CRON[12513]: (pam_unix) session closed
for user root
Oct 10 09:17:01 ubuntu-laptop CRON[12877]: (pam_unix) session opened
for user root by (uid=0)
Oct 10 09:17:01 ubuntu-laptop CRON[12877]: (pam_unix) session closed
for user root
Oct 10 15:17:01 ubuntu-laptop CRON[13872]: (pam_unix) session opened
for user root by (uid=0)
Oct 10 15:17:01 ubuntu-laptop CRON[13872]: (pam_unix) session closed
for user root
Oct 10 19:17:01 ubuntu-laptop CRON[15888]: (pam_unix) session opened
for user root by (uid=0)
Oct 10 19:17:01 ubuntu-laptop CRON[15888]: (pam_unix) session closed
for user root
Oct 10 20:17:02 ubuntu-laptop CRON[15987]: (pam_unix) session opened
for user root by (uid=0)
Oct 10 20:17:02 ubuntu-laptop CRON[15987]: (pam_unix) session closed
for user root
Oct 10 20:25:17 ubuntu-laptop login[4662]: (pam_unix) authentication
failure; logname= uid=0 euid=0 tty=tty4 ruser= rhost=  user=root
Oct 10 20:25:19 ubuntu-laptop login[4662]: FAILED LOGIN (1) on 'tty4'
FOR `root', Authentication failure
Oct 10 20:25:28 ubuntu-laptop login[4662]: (pam_unix) session opened
for user root by (uid=0)
Oct 10 20:25:28 ubuntu-laptop login[16205]: ROOT LOGIN  on 'tty4'

Dotan Cohen

http://what-is-what.com
http://gibberish.co.il
א-ב-ג-ד-ה-ו-ז-ח-ט-י-ך-כ-ל-ם-מ-ן-נ-ס-ע-ף-פ-ץ-צ-ק-ר-ש-ת