OSSEC Alert - iris - Level 2 - Unknown problem somewhere in the system.

Tue Oct 8 03:00:52 EDT 2019

OSSEC HIDS Notification.
2019 Oct 08 00:19:47

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:19:47 iris sshguard[84562]: Attack from "177.69.237.49" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:19:54

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:19:53 iris sshguard[84562]: Attack from "175.139.242.49" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:19:54

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:19:53 iris sshguard[84562]: Blocking "175.139.242.49/32" for 960 secs (3 attacks in 255 secs, after 4 abuses over 2759 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:19:54

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:19:53 iris sshd[39381]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:24:39

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:24:38 iris sshguard[84562]: Attack from "177.69.237.49" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:24:39

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:24:38 iris sshguard[84562]: Blocking "177.69.237.49/32" for 960 secs (3 attacks in 291 secs, after 4 abuses over 3400 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:24:39

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:24:38 iris sshd[13501]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:27:40

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:27:38 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:34:44

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:34:42 iris sshguard[84562]: Attack from "162.243.253.67" on service 100 with danger 2.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:37:41

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:37:39 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:37:41

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:37:41 iris sshguard[84562]: Attack from "175.139.242.49" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:42:02

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:42:00 iris sshguard[84562]: Attack from "175.139.242.49" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:42:02

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:42:00 iris sshguard[84562]: Blocking "175.139.242.49/32" for 1920 secs (3 attacks in 259 secs, after 5 abuses over 4086 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:42:02

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:42:00 iris sshd[71583]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:42:50

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:42:50 iris sshguard[84562]: Attack from "132.232.112.25" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:42:52

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:42:51 iris sshguard[84562]: Attack from "132.232.112.25" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:43:31

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:43:30 iris sshguard[84562]: Attack from "177.69.237.49" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:43:31

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:43:30 iris sshguard[84562]: Attack from "177.69.237.49" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:43:31

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:43:30 iris sshguard[84562]: Blocking "177.69.237.49/32" for 1920 secs (3 attacks in 0 secs, after 5 abuses over 4532 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:45:35

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:45:35 iris dhclient[58870]: em0: sendmsg(DHCPREQUEST): Permission denied

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:47:40

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:47:39 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:52:37

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:52:36 iris sshguard[84562]: Attack from "140.143.222.95" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:52:37

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:52:36 iris sshguard[84562]: Attack from "140.143.222.95" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:52:37

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:52:36 iris sshguard[84562]: Blocking "140.143.222.95/32" for 7680 secs (3 attacks in 0 secs, after 7 abuses over 10655 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:53:01

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:53:00 iris sshguard[84562]: Attack from "162.243.253.67" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:53:01

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:53:00 iris sshguard[84562]: Attack from "162.243.253.67" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:53:01

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:53:00 iris sshguard[84562]: Blocking "162.243.253.67/32" for 240 secs (3 attacks in 0 secs, after 2 abuses over 6724 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 00:57:41

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 02:57:39 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION