PAM Log Filter - Failed password for root from 10.32.0.113 port 55185 ssh2


Userlevel 2
After upgrading from 9.15 to 9.21, we had these error : We are using two C25 with HA, and we have only this en the "Slave" C25 05/14/16 16:20:46 Info PAM Log Filter May 14 16:20:46 C25--Master.net sshd[3831]: Failed password for root from 10.32.0.113 port 55188 ssh2 05/14/16 16:19:16 Info PAM Log Filter May 14 16:19:16 C25-Sodexo-.net gui_s_mgr: (pam_unix) session opened for user WC by (uid=0) 05/14/16 16:19:10 Info Config Manager Upgrading Wireless AP image: Serial 12472019236A0000, from 09.15.10.0004 to 09.21.08.0013 05/14/16 16:19:10 Info RU Session Manager Wireless AP registration and authentication succeeded. (AP SN 12472019236A0000 AP IP 10.32.180.91 (active tunnel), Certificate Can anyone have got already this ?

4 replies

Userlevel 6
Hi Pascal

Are you still having this issue?

What is 10.32.0.113? Are the controller interfaces protected from sources that might attempt scripted SSH attacks?

-Gareth
Userlevel 2
Hi, It was a scanner ... no problem 🙂 Thanks !
Userlevel 6
Pascal Lurquin wrote:

Hi, It was a scanner ... no problem 🙂 Thanks !

Ok great!

Thanks for the feedback Pascal!

-Gareth
Userlevel 6
For reference I created this article to cover this question: https://gtacknowledge.extremenetworks.com/articles/Solution/Info-PAM-Log-Filter-sshd-xxxx-Failed-password-for-root-message-seen-in-controller-log

-Gareth

Reply