Re: SSH faking auth loop : what does it mean?
At 988221808s since epoch (04/25/01 14:03:28 -0400 UTC), hanasaki wrote:
> The below turned up in my syslog the other day... Can someone please
> explain it?
>
> Apr 25 00:45:00 portal sshd[23291]: Faking authloop for illegal user
> administrator from 4.60 ...
When somebody tries to log on to your machine with a username that doesn't
exist, SSH 'goes through the motions' of asking for the user's password,
even though it knows that the username won't work.
It does this so that somebody can't figure out which accounts are valid on
your machine by guessing and seeing which it gets a valid authloop for.
After all, if SSH just dumped connections that had a bad username, it would
be easy to find out which accounts exist, and thus which ones to try to
break into.
Since you don't have an 'administrator' account, you should probably
administer The Smack to whoever is trying to guess their way into your box.
Jason
--
Jason Healy | jhealy@logn.net
LogN Systems | http://www.logn.net/
Reply to: