Security Question
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-21-2005 06:36 AM - edited 03-10-2019 02:01 PM
I noticed this in my log this morning. Is there anyway I can find the IP address of the person trying to log into my router (1711)?
001315: Feb 21 08:11:48.548 EST: SSH0: password authentication failed for test
001316: Feb 21 08:11:48.548 EST: SSH0: AAA authentication fail reason: Password:
001317: Feb 21 08:11:52.356 EST: SSH0: password authentication failed for guest
001318: Feb 21 08:11:52.356 EST: SSH0: AAA authentication fail reason: Password:
001319: Feb 21 08:11:54.892 EST: SSH0: password authentication failed for admin
001320: Feb 21 08:11:54.892 EST: SSH0: AAA authentication fail reason: Password:
001321: Feb 21 08:11:57.528 EST: SSH0: password authentication failed for admin
001322: Feb 21 08:11:57.532 EST: SSH0: AAA authentication fail reason: Password:
001323: Feb 21 08:12:00.324 EST: SSH0: password authentication failed for user
001324: Feb 21 08:12:00.324 EST: SSH0: AAA authentication fail reason: Password:
001325: Feb 21 08:12:02.953 EST: SSH0: password authentication failed for root
001326: Feb 21 08:12:02.953 EST: SSH0: AAA authentication fail reason: Password:
001327: Feb 21 08:12:05.657 EST: SSH0: password authentication failed for root
001328: Feb 21 08:12:05.661 EST: SSH0: AAA authentication fail reason: Password:
001329: Feb 21 08:12:08.173 EST: SSH0: password authentication failed for root
001330: Feb 21 08:12:08.173 EST: SSH0: AAA authentication fail reason: Password:
001331: Feb 21 08:12:10.733 EST: SSH0: password authentication failed for test
001332: Feb 21 08:12:10.733 EST: SSH0: AAA authentication fail reason: Password:
- Labels:
-
AAA
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-25-2005 10:04 AM
Try the "show users " command in the router.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-28-2005 01:55 AM
Are you using the ACS server for authentication? If so you shuld be able to look in the 'failed attempt' report and look up the 'caller ID'.
