On 28/02/07, mcclnx mcc mcclnx@yahoo.com.tw wrote:

We have CENTOS 4.4 on DELL server. I found if I login use 'ssh" ther will have two entries on /var/log/secure. One entry use local time and another entry use "green witch time,. (I guess).

It ONLY happen on ssh. Telnet, FTP and Sftp no problem.

Does any one know why?

Feb 28 14:01:20 ORA04 sshd[24338]: Accepted password for oracle from ::ffff:172.29.94.230 port 34470 ssh2 Feb 28 19:01:20 ORA04 sshd[24339]: Accepted password for oracle from ::ffff:172.29.94.230 port 34470 ssh2 Feb 28 20:48:26 ORA04 sshd[24533]: Accepted password for oracle from ::ffff:172.30.10.141 port 2459 ssh2 Feb 28 15:48:26 ORA04 sshd[24532]: Accepted password for oracle from ::ffff:172.30.10.141 port 2459 ssh2 Feb 28 16:06:02 ORA04 xinetd[5007]: START: telnet pid=24624 from=172.30.11.243 Feb 28 17:41:25 ORA04 sshd[24969]: Accepted password for oracle from ::ffff:172.30.11.245 port 47048 ssh2 Feb 28 17:41:25 ORA04 sshd[24971]: subsystem request for sftp

This sounds like an old problem that cropped up with SSH and logging a while back.

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=203671

http://lists.centos.org/pipermail/centos/2006-November/072477.html

Is your sshd package up to date?

Will.