OSSEC Alert - iris - Level 2 - Unknown problem somewhere in the system.

Tue Oct 8 01:00:18 EDT 2019

OSSEC HIDS Notification.
2019 Oct 07 22:20:10

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:20:09 iris sshguard[84562]: Attack from "200.52.80.34" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:20:10

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:20:09 iris sshguard[84562]: Blocking "200.52.80.34/32" for 3840 secs (3 attacks in 433 secs, after 6 abuses over 9941 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:20:10

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:20:09 iris sshd[46674]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:20:42

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:20:42 iris sshguard[84562]: Attack from "185.197.30.74" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:22:51

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:22:50 iris sshguard[84562]: Attack from "140.143.222.95" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:24:09

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:24:07 iris sshguard[84562]: Attack from "95.243.136.198" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:27:32

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:27:32 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:27:32

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:27:31 iris sshguard[84562]: Attack from "140.143.222.95" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:27:32

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:27:31 iris sshguard[84562]: Blocking "140.143.222.95/32" for 480 secs (3 attacks in 281 secs, after 3 abuses over 1950 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:27:32

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:27:31 iris sshd[9411]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:28:26

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:28:25 iris sshguard[84562]: Attack from "95.243.136.198" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:28:26

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:28:25 iris sshguard[84562]: Blocking "95.243.136.198/32" for 15360 secs (3 attacks in 258 secs, after 8 abuses over 17965 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:28:26

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:28:25 iris sshd[40226]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:33:18

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:33:17 iris sshguard[84562]: Attack from "185.197.30.74" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:33:18

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:33:17 iris sshguard[84562]: Blocking "185.197.30.74/32" for 120 secs (3 attacks in 755 secs, after 1 abuses over 755 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:33:18

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:33:17 iris sshd[21433]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:36:39

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:36:39 iris sshguard[84562]: Attack from "140.143.222.95" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:37:01

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:37:00 iris sshguard[84562]: Attack from "185.197.30.74" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:37:33

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:37:32 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:40:54

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:40:52 iris sshguard[84562]: Attack from "200.16.132.202" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:40:54

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:40:53 iris sshguard[84562]: Attack from "200.16.132.202" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:40:54

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:40:53 iris sshguard[84562]: Blocking "200.16.132.202/32" for 15360 secs (3 attacks in 1 secs, after 8 abuses over 18990 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:40:58

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:40:58 iris sshguard[84562]: Attack from "185.197.30.74" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:40:58

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:40:58 iris sshguard[84562]: Blocking "185.197.30.74/32" for 240 secs (3 attacks in 238 secs, after 2 abuses over 1216 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:40:58

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:40:58 iris sshd[80542]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:41:34

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:41:34 iris sshguard[84562]: Attack from "140.143.222.95" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:41:34

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:41:34 iris sshguard[84562]: Blocking "140.143.222.95/32" for 960 secs (3 attacks in 295 secs, after 4 abuses over 2793 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:41:34

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:41:34 iris sshd[70200]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:41:44

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:41:44 iris sshguard[84562]: Attack from "162.243.253.67" on service 100 with danger 2.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:45:03

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:45:03 iris dhclient[58870]: em0: sendmsg(DHCPREQUEST): Permission denied

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:47:34

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:47:32 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:48:36

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:48:36 iris sshguard[84562]: Attack from "185.197.30.74" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:52:35

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:52:34 iris sshguard[84562]: Attack from "185.197.30.74" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:52:35

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:52:34 iris sshguard[84562]: Blocking "185.197.30.74/32" for 480 secs (3 attacks in 238 secs, after 3 abuses over 1912 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:52:35

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:52:34 iris sshd[83741]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:54:14

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:54:13 iris sshguard[84562]: Attack from "58.214.0.70" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:54:38

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:54:38 iris sshguard[84562]: Attack from "123.206.22.145" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:57:33

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:57:32 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:58:35

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:58:34 iris sshguard[84562]: Attack from "58.214.0.70" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:58:35

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:58:34 iris sshguard[84562]: Blocking "58.214.0.70/32" for 7680 secs (3 attacks in 261 secs, after 7 abuses over 10954 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:58:35

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:58:34 iris sshd[13243]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:59:01

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:59:01 iris sshguard[84562]: Attack from "123.206.22.145" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:59:01

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:59:01 iris sshguard[84562]: Blocking "123.206.22.145/32" for 7680 secs (3 attacks in 263 secs, after 7 abuses over 10288 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 22:59:01

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 00:59:01 iris sshd[50249]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:00:16

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:00:16 iris sshguard[84562]: Attack from "140.143.222.95" on service 100 with danger 10.

 --END OF NOTIFICATION