Hi Yah, Have logcheck running and the following came up this morning...
Oct 30 14:01:40 ns PAM_pwdb[4984]: check pass; user unknown Oct 30 14:01:53 ns PAM_pwdb[6065]: check pass; user unknown Oct 30 14:01:59 ns PAM_pwdb[6066]: check pass; user unknown Oct 30 14:02:07 ns PAM_pwdb[6090]: check pass; user unknown Oct 30 14:02:31 ns PAM_pwdb[5832]: check pass; user unknown Oct 30 14:03:20 ns PAM_pwdb[4658]: check pass; user unknown Oct 30 14:03:33 ns PAM_pwdb[4549]: check pass; user unknown The FTP activities are logged also but nothing else in all the logs shown any more details where can I find or how can I find out where this user is coming from? Could it be somone at the collocation? Many thanks in advance Chae _______________________________________________ cobalt-security mailing list [EMAIL PROTECTED] http://list.cobalt.com/mailman/listinfo/cobalt-security
