----- Original Message ----- From: "Render-Vue" <[EMAIL PROTECTED]> Sent: Tuesday, October 30, 2001 5:12 PM Subject: [cobalt-security] Where can I find more about these log reports
> Have logcheck running and the following came up this morning... > > Oct 30 14:01:40 ns PAM_pwdb[4984]: check pass; user unknown > > The FTP activities are logged also but nothing else in all the logs shown > any more details where can I find or how can I find out where this user is > coming from? Could it be somone at the collocation? When I see this it's usually someone who was trying to gain access to a part off a web site containing an .htaccess file - maybe like their stats (if your running webalizer). Like the message says, "user unknown" Hope this helped a little... Dave~ _______________________________________________ cobalt-security mailing list [EMAIL PROTECTED] http://list.cobalt.com/mailman/listinfo/cobalt-security
