OSSEC Alert - iris - Level 2 - Unknown problem somewhere in the system.

Tue Oct 8 08:00:03 EDT 2019

OSSEC HIDS Notification.
2019 Oct 08 05:19:43

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:19:42 iris sshguard[84562]: Attack from "77.81.106.213" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:20:25

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:20:24 iris sshguard[84562]: Attack from "51.68.188.42" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:20:25

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:20:25 iris sshguard[84562]: Attack from "51.68.188.42" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:20:25

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:20:25 iris sshguard[84562]: Blocking "51.68.188.42/32" for 240 secs (3 attacks in 1 secs, after 2 abuses over 436 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:21:48

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:21:46 iris sshguard[84562]: Attack from "157.230.235.233" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:22:04

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:22:02 iris sshguard[84562]: Attack from "151.80.144.39" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:22:04

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:22:02 iris sshguard[84562]: Attack from "151.80.144.39" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:22:04

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:22:02 iris sshguard[84562]: Blocking "151.80.144.39/32" for 7680 secs (3 attacks in 0 secs, after 7 abuses over 10087 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:25:13

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:25:11 iris sshguard[84562]: Attack from "157.230.235.233" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:25:13

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:25:11 iris sshguard[84562]: Blocking "157.230.235.233/32" for 480 secs (3 attacks in 205 secs, after 3 abuses over 1780 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:25:13

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:25:11 iris sshd[22571]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:27:51

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:27:50 iris sshguard[84562]: Attack from "51.68.188.42" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:27:51

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:27:51 iris sshguard[84562]: Attack from "51.68.188.42" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:27:51

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:27:51 iris sshguard[84562]: Blocking "51.68.188.42/32" for 480 secs (3 attacks in 1 secs, after 3 abuses over 882 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:27:55

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:27:55 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:28:36

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:28:36 iris sshguard[84562]: Attack from "145.239.169.177" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:30:14

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:30:13 iris sshguard[84562]: Attack from "77.81.106.213" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:30:14

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:30:13 iris sshguard[84562]: Blocking "77.81.106.213/32" for 960 secs (3 attacks in 631 secs, after 4 abuses over 4749 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:30:14

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:30:13 iris sshd[1183]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:32:31

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:32:29 iris sshguard[84562]: Attack from "145.239.169.177" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:32:31

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:32:29 iris sshguard[84562]: Blocking "145.239.169.177/32" for 7680 secs (3 attacks in 233 secs, after 7 abuses over 10369 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:32:31

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:32:29 iris sshd[64934]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:35:42

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:35:40 iris sshguard[84562]: Attack from "157.230.235.233" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:36:00

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:35:58 iris sshguard[84562]: Attack from "40.73.7.223" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:36:00

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:35:59 iris sshguard[84562]: Attack from "40.73.7.223" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:36:00

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:35:59 iris sshguard[84562]: Blocking "40.73.7.223/32" for 7680 secs (3 attacks in 1 secs, after 7 abuses over 9432 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:37:56

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:37:56 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:39:03

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:39:01 iris sshguard[84562]: Attack from "157.230.235.233" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:39:03

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:39:01 iris sshguard[84562]: Blocking "157.230.235.233/32" for 960 secs (3 attacks in 201 secs, after 4 abuses over 2610 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:39:03

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:39:01 iris sshd[14422]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:39:47

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:39:47 iris sshguard[84562]: Attack from "51.68.188.42" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:43:46

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:43:45 iris sshguard[84562]: Attack from "51.68.188.42" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:43:46

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:43:45 iris sshguard[84562]: Blocking "51.68.188.42/32" for 960 secs (3 attacks in 238 secs, after 4 abuses over 1836 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:43:46

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:43:45 iris sshd[60945]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:46:37

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:46:36 iris dhclient[58870]: em0: sendmsg(DHCPREQUEST): Permission denied

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:47:57

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:47:56 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:51:26

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:51:26 iris sshguard[84562]: Attack from "77.81.106.213" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:51:28

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:51:27 iris sshguard[84562]: Attack from "77.81.106.213" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:53:55

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:53:55 iris sshguard[84562]: Attack from "37.187.6.235" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:56:22

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:56:21 iris sshguard[84562]: Attack from "157.230.235.233" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:57:56

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:57:56 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:59:53

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:59:53 iris sshguard[84562]: Attack from "157.230.235.233" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:59:53

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:59:53 iris sshguard[84562]: Blocking "157.230.235.233/32" for 1920 secs (3 attacks in 212 secs, after 5 abuses over 3862 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 05:59:53

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 07:59:53 iris sshd[13928]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION