Re: tlug: Strange entry in /var/log/messages

[Chris Sekiya <chris@example.com>]

On Thu, 25 Mar 1999, Manuel M. T. Chakravarty wrote:

> (a) It's time is out of sync with the preceding and following
>     entry.

... and the PID is not in sequence.  Looks like rlogind took a _long_ time
to timeout.

> (b) How can root (uid=0) have an authentication failure?

I read that as 'a service accessing the password database as uid 0 had an
authentication failure'. in.rlogind runs as root.

It doesn't smell like an attack.

-- Chris


-------------------------------------------------------------------
Next Technical Meeting: April 10 (Sat), 12:30   place: Temple Univ.
*** featuring: LabView and UDB/DB2 for Linux
Next Nomikai: May 21 (Fri), 19:30    Tengu TokyoEkiMae 03-3275-3691
-------------------------------------------------------------------
more info: http://www.tlug.gr.jp        Sponsor: Global Online Japan