These are notifications that fail2ban is adding firewall rules to one or both of the logins because someone or something has too many failed authentication attempts.

Admins is currently the only appropriate mailing list we have to send notifications like this to.

Ben


From: Rajeev Thakur <thakur@mcs.anl.gov>
Sent: Jul 29, 2014 8:17 AM
To: admins@jlse.anl.gov
Subject: Re: [JLSE-Admins] [Fail2Ban] SSH: banned 219.138.135.59 on

What are these messages?

On Jul 29, 2014, at 7:16 AM, Fail2Ban <fail2ban@alcf.anl.gov> wrote:

>
> The IP 219.138.135.59 has just been banned by Fail2Ban after
> 18 attempts against SSH.
>
> Latest lines containing IP:219.138.135.59 in /var/log/syslog/sshd.log
>
> Jul 29 12:16:18 ftlogin2 sshd[7078]: error: PAM: Authentication failure for root from 219.138.135.59
> Jul 29 12:16:18 ftlogin2 sshd[7078]: Failed keyboard-interactive/pam for root from 219.138.135.59 port 42378 ssh2
> Jul 29 12:16:18 ftlogin2 sshd[7072]: error: PAM: Authentication failure for root from 219.138.135.59
> Jul 29 12:16:18 ftlogin2 sshd[7072]: Failed keyboard-interactive/pam for root from 219.138.135.59 port 42366 ssh2
> Jul 29 12:16:18 ftlogin2 sshd[7066]: error: PAM: Authentication failure for root from 219.138.135.59
> Jul 29 12:16:18 ftlogin2 sshd[7066]: Failed keyboard-interactive/pam for root from 219.138.135.59 port 42357 ssh2
> Jul 29 12:16:18 ftlogin2 sshd[7080]: error: PAM: Authentication failure for root from 219.138.135.59
> Jul 29 12:16:18 ftlogin2 sshd[7080]: Failed keyboard-interactive/pam for root from 219.138.135.59 port 42381 ssh2
> Jul 29 12:16:18 ftlogin2 sshd[7079]: error: PAM: Authentication failure for root from 219.138.135.59
> Jul 29 12:16:18 ftlogin2 sshd[7079]: Failed keyboard-interactive/pam for root from 219.138.135.59 port 42369 ssh2
>
>
> - Fail2ban on
> _______________________________________________
> Admins mailing list
> Admins@lists.jlse.anl.gov
> https://lists.jlse.anl.gov/mailman/listinfo/admins

_______________________________________________
Admins mailing list
Admins@lists.jlse.anl.gov
https://lists.jlse.anl.gov/mailman/listinfo/admins