Explanation of ftpd syslog entry 1

[Tardigrade]

Hello all,

This probably sounds like a dumb question but believe me I've searched everywhere for an answer.

Can anyone tell me exactly what the following syslog message means:

Jan 30 01:40:26 venus PAM_unix[12057]: authentication failure; (uid=0) -> thomas for ftp service

Is this simply a failed FTP login? whats the significance of '(uid=0) -> thomas'

Many thanks
--
Scott

 

[ackka]

UID is some type of unique identifier. In programming =0 basically means false or the operation failed. My guess is Unique identifier failed or was not valid, thats was UID=0 means. It may be a failed logon attempt ???

ackka
ackka@mad.scientist.com

http://home.cyberarmy.com/ackka

http://www.cultdeadcow.com

 

[cbrae]

someone is trying to ftp as root and was denied access ....

without running something like tcpd to intercept ftpd it will be hard to determine who

talk to your system admin

 

[mufka]

If someone were trying to ftp as root, wouldn't it say root instead of thomas? Or since it it uid=0 do we assume that thomas IS root?

 

[cbrae]

No --- some host by the name of thomas is attempting to connect to your server as
root


thomas is not the user but the actual computer name

one thing you may want to do is issue a traceroute thomas this might point to where the server is located (IP address)

generally ftp is denied to root under all circumstances .....