topic RE: PAM Log Filter - Failed password for root from 10.32.0.113 port 55185 ssh2 in ExtremeWireless (Identifi)

PAM Log Filter - Failed password for root from 10.32.0.113 port 55185 ssh2

Pascal_Lurquin — Sun, 15 May 2016 15:28:00 GMT

After upgrading from 9.15 to 9.21, we had these error : We are using two C25 with HA, and we have only this en the "Slave" C25 05/14/16 16:20:46 Info PAM Log Filter May 14 16:20:46 C25--Master.net sshd[3831]: Failed password for root from 10.32.0.113 port 55188 ssh2 05/14/16 16:19:16 Info PAM Log Filter May 14 16:19:16 C25-Sodexo-.net gui_s_mgr: (pam_unix) session opened for user WC by (uid=0) 05/14/16 16:19:10 Info Config Manager Upgrading Wireless AP image: Serial 12472019236A0000, from 09.15.10.0004 to 09.21.08.0013 05/14/16 16:19:10 Info RU Session Manager Wireless AP registration and authentication succeeded. (AP SN 12472019236A0000 AP IP 10.32.180.91 (active tunnel), Certificate Can anyone have got already this ?

RE: PAM Log Filter - Failed password for root from 10.32.0.113 port 55185 ssh2

Gareth_Mitchell — Wed, 18 May 2016 14:19:00 GMT

Hi Pascal

Are you still having this issue?

What is 10.32.0.113? Are the controller interfaces protected from sources that might attempt scripted SSH attacks?

-Gareth

RE: PAM Log Filter - Failed password for root from 10.32.0.113 port 55185 ssh2

Pascal_Lurquin — Tue, 24 May 2016 18:23:00 GMT

Hi, It was a scanner ... no problem  Thanks !

RE: PAM Log Filter - Failed password for root from 10.32.0.113 port 55185 ssh2

Gareth_Mitchell — Tue, 24 May 2016 18:23:00 GMT

Ok great!

Thanks for the feedback Pascal!

-Gareth

RE: PAM Log Filter - Failed password for root from 10.32.0.113 port 55185 ssh2

Gareth_Mitchell — Tue, 24 May 2016 19:00:00 GMT

For reference I created this article to cover this question: https://gtacknowledge.extremenetworks.com/articles/Solution/Info-PAM-Log-Filter-sshd-xxxx-Failed-password-for-root-message-seen-in-controller-log

-Gareth