These are notifications that fail2ban is adding firewall rules to one or both of the logins because someone or something has too many failed authentication attempts. Admins is currently the only appropriate mailing list we have to send notifications like this to. Ben From: Rajeev Thakur <[email protected]> Sent: Jul 29, 2014 8:17 AM To: [email protected] Subject: Re: [JLSE-Admins] [Fail2Ban] SSH: banned 219.138.135.59 on What are these messages? On Jul 29, 2014, at 7:16 AM, Fail2Ban <[email protected]> wrote:

The IP 219.138.135.59 has just been banned by Fail2Ban after 18 attempts against SSH.

Latest lines containing IP:219.138.135.59 in /var/log/syslog/sshd.log

Jul 29 12:16:18 ftlogin2 sshd[7078]: error: PAM: Authentication failure for root from 219.138.135.59 Jul 29 12:16:18 ftlogin2 sshd[7078]: Failed keyboard-interactive/pam for root from 219.138.135.59 port 42378 ssh2 Jul 29 12:16:18 ftlogin2 sshd[7072]: error: PAM: Authentication failure for root from 219.138.135.59 Jul 29 12:16:18 ftlogin2 sshd[7072]: Failed keyboard-interactive/pam for root from 219.138.135.59 port 42366 ssh2 Jul 29 12:16:18 ftlogin2 sshd[7066]: error: PAM: Authentication failure for root from 219.138.135.59 Jul 29 12:16:18 ftlogin2 sshd[7066]: Failed keyboard-interactive/pam for root from 219.138.135.59 port 42357 ssh2 Jul 29 12:16:18 ftlogin2 sshd[7080]: error: PAM: Authentication failure for root from 219.138.135.59 Jul 29 12:16:18 ftlogin2 sshd[7080]: Failed keyboard-interactive/pam for root from 219.138.135.59 port 42381 ssh2 Jul 29 12:16:18 ftlogin2 sshd[7079]: error: PAM: Authentication failure for root from 219.138.135.59 Jul 29 12:16:18 ftlogin2 sshd[7079]: Failed keyboard-interactive/pam for root from 219.138.135.59 port 42369 ssh2

- Fail2ban on _______________________________________________ Admins mailing list [email protected] https://lists.jlse.anl.gov/mailman/listinfo/admins

_______________________________________________ Admins mailing list [email protected] https://lists.jlse.anl.gov/mailman/listinfo/admins