Hi.
The auditd logs are full of lines referencing 28756E6B6E6F776E207573657229 , but I can't identify this account
type=USER_LOGIN msg=audit(1364926580.306:249814): user pid=22565 uid=0 auid=4294967295 ses=4294967295 msg='op=login acct=28756E6B6E6F776E207573657229 exe="/usr/sbin/sshd" hostname=? addr=127.0.0.1 terminal=ssh res=failed'
What would typically cause this ? There are no other references in any of the other logs to 28756E6B6E6F776E207573657229 and its to long for our typical UID / GID .
Thanks
G
Am 08.04.2013 07:04, schrieb Gregory Machin:
type=USER_LOGIN msg=audit(1364926580.306:249814): user pid=22565 uid=0 auid=4294967295 ses=4294967295 msg='op=login acct=28756E6B6E6F776E207573657229 exe="/usr/sbin/sshd" hostname=? addr=127.0.0.1 terminal=ssh res=failed'
What would typically cause this ? There are no other references in any of the other logs to 28756E6B6E6F776E207573657229 and its to long for our typical UID / GID .
Looks like a hex dump of an ASCII string:
28756E6B6E6F776E207573657229 ( u n k n o w n u s e r )
HTH T.
-
Gregory Machin -
Tilman Schmidt