Glorious1
Guru
- Joined
- Nov 23, 2014
- Messages
- 1,211
I just happened to look at /var/log/auth.log and found a constant stream of these:
It looks like root is logging in and getting logged out constantly at a fast rate. I don't understand what's going on here or why. It may be related to the fact that I have FreeNAS setup to replicate one volume to another volume locally (the remote hostname for the replication task is localhost), but that only happens once per day. This isn't normal, is it?
Code:
Aug 29 07:26:08 Tabernacle sshd[36571]: Accepted publickey for root from 127.0.0.1 port 41301 ssh2: RSA b0:ba:9f:a3:bd:08:aa:b1:44:20:37:76:d4:28:e1:c2 Aug 29 07:26:08 Tabernacle sshd[36571]: Received disconnect from 127.0.0.1: 11: disconnected by user Aug 29 07:27:07 Tabernacle sshd[36651]: Accepted publickey for root from 127.0.0.1 port 61709 ssh2: RSA b0:ba:9f:a3:bd:08:aa:b1:44:20:37:76:d4:28:e1:c2 Aug 29 07:27:07 Tabernacle sshd[36651]: Received disconnect from 127.0.0.1: 11: disconnected by user Aug 29 07:27:08 Tabernacle sshd[36658]: Accepted publickey for root from 127.0.0.1 port 29685 ssh2: RSA b0:ba:9f:a3:bd:08:aa:b1:44:20:37:76:d4:28:e1:c2 Aug 29 07:27:08 Tabernacle sshd[36658]: Received disconnect from 127.0.0.1: 11: disconnected by user Aug 29 07:27:08 Tabernacle sshd[36665]: Accepted publickey for root from 127.0.0.1 port 14298 ssh2: RSA b0:ba:9f:a3:bd:08:aa:b1:44:20:37:76:d4:28:e1:c2 Aug 29 07:27:08 Tabernacle sshd[36665]: Received disconnect from 127.0.0.1: 11: disconnected by user Aug 29 07:27:08 Tabernacle sshd[36672]: Accepted publickey for root from 127.0.0.1 port 30548 ssh2: RSA b0:ba:9f:a3:bd:08:aa:b1:44:20:37:76:d4:28:e1:c2 Aug 29 07:27:08 Tabernacle sshd[36672]: Received disconnect from 127.0.0.1: 11: disconnected by user
It looks like root is logging in and getting logged out constantly at a fast rate. I don't understand what's going on here or why. It may be related to the fact that I have FreeNAS setup to replicate one volume to another volume locally (the remote hostname for the replication task is localhost), but that only happens once per day. This isn't normal, is it?