Re: [cobalt-users] RAQ3 check pass; user unknown - Again

["Sqlcoders.com Programming Dept" <coders@xxxxxxxxxxxxx>]

just a thought for what's its worth, if its someone checking their stats,
I'd assume they'll email you soon enough for the right pwd.

might help cut out some of the unlikely possibilities, or I might be wrong
and mudding the waters LOL

----- Original Message -----
From: "Render-Vue" <sales@xxxxxxxxxxxxxx>
To: <cobalt-users@xxxxxxxxxxxxxxx>
Sent: Wednesday, November 07, 2001 6:34 PM
Subject: [cobalt-users] RAQ3 check pass; user unknown - Again


> Sorry for a repost but this event has cropped up again...came through from
> logcheck
>
> Nov  7 15:42:18 ns PAM_pwdb[3800]: check pass; user unknown
> Nov  7 15:42:21 ns PAM_pwdb[4191]: check pass; user unknown
> Nov  7 15:42:48 ns PAM_pwdb[3717]: check pass; user unknown
> Nov  7 15:42:50 ns PAM_pwdb[4215]: check pass; user unknown
> Nov  7 15:43:35 ns PAM_pwdb[3800]: check pass; user unknown
> Nov  7 15:43:38 ns PAM_pwdb[4242]: check pass; user unknown
> Nov  7 15:44:27 ns PAM_pwdb[3720]: check pass; user unknown
> Nov  7 15:44:29 ns PAM_pwdb[4320]: check pass; user unknown
> Nov  7 15:44:35 ns PAM_pwdb[3720]: check pass; user unknown
> Nov  7 15:44:38 ns PAM_pwdb[4331]: check pass; user unknown
> Nov  7 15:44:45 ns PAM_pwdb[3720]: check pass; user unknown
> Nov  7 15:44:47 ns PAM_pwdb[4357]: check pass; user unknown
> Nov  7 15:44:50 ns PAM_pwdb[3720]: check pass; user unknown
> Nov  7 15:44:52 ns PAM_pwdb[4359]: check pass; user unknown
> Nov  7 15:45:04 ns PAM_pwdb[3720]: check pass; user unknown
> Nov  7 15:45:06 ns PAM_pwdb[4370]: check pass; user unknown
> Nov  7 15:45:28 ns PAM_pwdb[3719]: check pass; user unknown
> Nov  7 15:45:31 ns PAM_pwdb[4390]: check pass; user unknown
> Nov  7 15:45:49 ns PAM_pwdb[3916]: check pass; user unknown
> Nov  7 15:45:51 ns PAM_pwdb[4410]: check pass; user unknown
> Nov  7 15:46:19 ns PAM_pwdb[3719]: check pass; user unknown
> Nov  7 15:46:21 ns PAM_pwdb[4432]: check pass; user unknown
> Nov  7 15:46:34 ns PAM_pwdb[3719]: check pass; user unknown
> Nov  7 15:46:36 ns PAM_pwdb[3718]: check pass; user unknown
> Nov  7 15:46:36 ns PAM_pwdb[4433]: check pass; user unknown
> Nov  7 15:46:38 ns PAM_pwdb[4434]: check pass; user unknown
> Nov  7 15:46:40 ns PAM_pwdb[3718]: check pass; user unknown
> Nov  7 15:46:43 ns PAM_pwdb[4436]: check pass; user unknown
>
> Now I've just gone through all of the log files listed below and I can't
see
> anything that ties in with the times above - the nearest thing is when I
> checked the xferlog these events happened just after one user had logged
in
> via FTP and was uploading files to the site...only on a few occassions did
> the time happen to be a few seconds of one another, some around a minute.
> In the maillog one or two of the times coincided with a qpopper event but
> that's it.
>
> /var/log/messages - *.info ; mail.none ; authpriv.none
> /var/log/secure  - authpriv.*
> /var/log/maillog  - mail.*
> /var/log/xferlog  - *.*
>
> Anyone have any ideas - someone did mention it might be someone trying to
> check their stats and using the wrong password - is there anyway of
actually
> confirming this is what they are doing ?
>
> Many thanks in advance
>
> Chae
>
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users
>