LOGIN FAILURES ON ttyC0

classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|

LOGIN FAILURES ON ttyC0

Federico Giannici
Since a couple of days a lot of the following line are logged in
"/var/log/messages":

Nov 28 12:30:23 arwen login: 9 LOGIN FAILURES ON ttyC0

What this means?
Isn't "ttyC0" the console? I'm sure that nobody is trying to log from
the console...


Thanks.

--
___________________________________________________
     __
    |-                      [hidden email]
    |ederico Giannici      http://www.neomedia.it
___________________________________________________

Reply | Threaded
Open this post in threaded view
|

Re: LOGIN FAILURES ON ttyC0

Eric Pancer
On Mon, 2005-11-28 at 12:59:18 +0100, Federico Giannici proclaimed...

> Isn't "ttyC0" the console? I'm sure that nobody is trying to log from
> the console...

It is the first virtual terminal on x86 architectures. Logs don't lie, so
you might want to track it down, or see if you're flubbing passwords.

Reply | Threaded
Open this post in threaded view
|

Re: LOGIN FAILURES ON ttyC0

Federico Giannici
eric wrote:
> On Mon, 2005-11-28 at 12:59:18 +0100, Federico Giannici proclaimed...
>
>
>>Isn't "ttyC0" the console? I'm sure that nobody is trying to log from
>>the console...
>
>
> It is the first virtual terminal on x86 architectures. Logs don't lie, so
> you might want to track it down, or see if you're flubbing passwords.

OK, but what I want to know is: is it the PHYSICAL console of the PC?
I have it in front of me, so I can see that nobody is using it!


Thanks.

--
___________________________________________________
     __
    |-                      [hidden email]
    |ederico Giannici      http://www.neomedia.it
___________________________________________________

Reply | Threaded
Open this post in threaded view
|

Re: LOGIN FAILURES ON ttyC0

Joachim Schipper
On Mon, Nov 28, 2005 at 07:24:05PM +0100, Federico Giannici wrote:

> eric wrote:
> >On Mon, 2005-11-28 at 12:59:18 +0100, Federico Giannici proclaimed...
> >
> >
> >>Isn't "ttyC0" the console? I'm sure that nobody is trying to log from
> >>the console...
> >
> >
> >It is the first virtual terminal on x86 architectures. Logs don't lie, so
> >you might want to track it down, or see if you're flubbing passwords.
>
> OK, but what I want to know is: is it the PHYSICAL console of the PC?
> I have it in front of me, so I can see that nobody is using it!
>
>
> Thanks.

Since there were no replies to this post, I'll try and make a guess.

I'm *fairly* certain that ttyC0 is (the|a) console, and that serial
lines are numbered differently. Might be worth looking into, though.

If it's not a serial login, could it be that anyone is using the
computer while you are away? Anyway, best check for rootkits and change
passwords, at least.

                Joachim

Reply | Threaded
Open this post in threaded view
|

Re: LOGIN FAILURES ON ttyC0

Andrew Daugherity
In reply to this post by Federico Giannici
On 11/28/05, Federico Giannici <[hidden email]> wrote:

> eric wrote:
> > On Mon, 2005-11-28 at 12:59:18 +0100, Federico Giannici proclaimed...
> >
> >
> >>Isn't "ttyC0" the console? I'm sure that nobody is trying to log from
> >>the console...
> >
> >
> > It is the first virtual terminal on x86 architectures. Logs don't lie, so
> > you might want to track it down, or see if you're flubbing passwords.
>
> OK, but what I want to know is: is it the PHYSICAL console of the PC?
> I have it in front of me, so I can see that nobody is using it!

Yes, it's the local keyboard/display.  ttyC0, ttyC1, ttyC2, etc. are
the "virtual" consoles accessed from the keyboard by Ctrl-Alt-F1,
C-A-F2, CA-F3, etc.  A serial console would be tty00, tty01, etc.  ssh
logins, xterms, etc., will be ttyp0 etc.

As has already been advised, check your logs, particularly authlog and secure.

Andrew