Voltar
-
Título
What does error "PAM: authentication error for illegal user" means? -
Descrição
K1000 Server Charlie Root has been sending periodic emails to Admin as below:
Mar 24 22:13:37 KBOX sshd[74118]: error: PAM: authentication error for illegal user someusername from KBOXMar 24 22:13:37 KBOX sshd[74118]: Failed keyboard-interactive/pam for invalid user someusername from 192.168.132.4 port 23730 ssh2Mar 24 22:13:37 KBOX sshd[74118]: Postponed keyboard-interactive for invalid user someusername from 192.16.132.4 port 23730 ssh2 [preauth] -
Causa
There are a couple of causes that triggers K1000 Server Charlie Root to log such errors and email out to the Admin email account.
One possibility is that a machines in the network is trying to access the K1000 Server via ssh protocol.
Do examine the From IP Address of the email error logs in order to determine where is the source of the attempted machine.
The other possibility is when the K1000 Server has the Agent Provisioning Schedules Enabled with the K1000 Server IP Address in the Target IP Range
For example, the K1000 Server IP Address is 192.168.132.4 and the Target IP Addresses or hostnames have the following IP Ranges as of 192.168.132.1-255
There is nothing wrong with Charlie Root, as it is doing its job to inform the Admin about invalid logins via ssh protocols. -
Resolução
- Check the PAM: authentication error logs for the user name and from which hostname.
- Identify the from IP Address belongs to which machine in the network and remove it from the Target IP Addresses or hostnames
- Go to Settings | Credentials
- Look for the Username that might have appeared in the email error logs.
- Go to Settings | Provisioning | Schedules | IP Range
- Find the K1000 Server IP Address and Disable that Schedule.
- Go to Settings | Provisioning | Provisioning Results
- Find the Provisioning Results IP Address that belongs to the K1000 Server and Disable it.