Root: 1 failure since last login

[Nils Kassube]

Dotan Cohen wrote:
> On 10/10/2007, Nils Kassube <kassube at gmx.net> wrote:
> > Dotan Cohen wrote:
> > > Thanks. There's a lot of root logins. Is that as scary as I think
> > > it is? This machine does have sshs running, but it's behind a
> > > router with no NAT forwarding.
> >
> > It looks quite normal. Those entries are mostly cron jobs. And the
> > failure was obviously a typo when you tried to login. Compare the
> > time stamps -
> >
> > there are only a few seconds from the failure to successful login:
> > > Oct 10 20:25:17 ubuntu-laptop login[4662]: (pam_unix)
> > > authentication failure; logname= uid=0 euid=0 tty=tty4 ruser=
> > > rhost=  user=root Oct 10 20:25:19 ubuntu-laptop login[4662]: FAILED
> > > LOGIN (1) on 'tty4' FOR `root', Authentication failure
> > > Oct 10 20:25:28 ubuntu-laptop login[4662]: (pam_unix) session
> > > opened for user root by (uid=0)
> > > Oct 10 20:25:28 ubuntu-laptop login[16205]: ROOT LOGIN  on 'tty4'
> >
> > Nils
>
> Yes, it would seem so. So, I suppose that the auth.log shows nothing
> related to my current problem. When one logs into root and gets the
> message "1 failure since last login", what would be a good next step
> to take?

OK, seems I wasn't clear enough :)

The message "1 failure since last login" was due to the fact that you had 
tried to login and mistyped the password. Your second try was successful, 
but you got the message because of the failed try a few seconds ago. 
Check the timestamps (date + time) - I am rather sure that was the time 
when you got the message.


Nils