OSSEC Alert - iris - Level 2 - Unknown problem somewhere in the system.

Tue Oct 8 12:01:07 EDT 2019

OSSEC HIDS Notification.
2019 Oct 08 09:20:33

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:20:33 iris sshguard[84562]: Attack from "182.16.103.136" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:20:41

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:20:39 iris sshguard[84562]: Attack from "96.78.175.36" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:24:40

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:24:40 iris sshguard[84562]: Attack from "96.78.175.36" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:24:40

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:24:40 iris sshguard[84562]: Blocking "96.78.175.36/32" for 960 secs (3 attacks in 241 secs, after 4 abuses over 2446 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:24:40

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:24:40 iris sshd[82869]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:26:04

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:26:03 iris sshguard[84562]: Attack from "182.16.103.136" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:26:04

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:26:03 iris sshguard[84562]: Blocking "182.16.103.136/32" for 480 secs (3 attacks in 330 secs, after 3 abuses over 2166 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:26:04

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:26:03 iris sshd[28861]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:27:53

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:27:52 iris sshguard[84562]: Attack from "51.75.70.30" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:27:53

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:27:53 iris sshguard[84562]: Attack from "51.75.70.30" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:28:11

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:28:10 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:32:28

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:32:27 iris sshguard[84562]: Attack from "51.75.70.30" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:32:28

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:32:27 iris sshguard[84562]: Blocking "51.75.70.30/32" for 1920 secs (3 attacks in 275 secs, after 5 abuses over 3870 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:32:28

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:32:27 iris sshd[66755]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:33:21

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:33:20 iris sshguard[84562]: Attack from "162.241.193.116" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:33:49

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:33:48 iris sshguard[84562]: Attack from "67.207.83.115" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:36:52

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:36:52 iris sshguard[84562]: Attack from "182.16.103.136" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:38:12

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:38:10 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:42:15

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:42:14 iris sshguard[84562]: Attack from "182.16.103.136" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:42:15

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:42:14 iris sshguard[84562]: Blocking "182.16.103.136/32" for 960 secs (3 attacks in 322 secs, after 4 abuses over 3137 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:42:15

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:42:14 iris sshd[9606]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:42:27

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:42:26 iris sshguard[84562]: Attack from "106.13.59.131" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:44:34

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:44:33 iris sshguard[84562]: Attack from "96.78.175.36" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:44:34

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:44:33 iris sshguard[84562]: Attack from "96.78.175.36" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:44:34

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:44:33 iris sshguard[84562]: Blocking "96.78.175.36/32" for 1920 secs (3 attacks in 0 secs, after 5 abuses over 3639 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:45:24

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:45:24 iris sshguard[84562]: Attack from "151.80.140.166" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:45:26

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:45:24 iris sshguard[84562]: Attack from "151.80.140.166" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:45:26

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:45:24 iris sshguard[84562]: Blocking "151.80.140.166/32" for 7680 secs (3 attacks in 0 secs, after 7 abuses over 10594 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:47:29

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:47:27 iris dhclient[58870]: em0: sendmsg(DHCPREQUEST): Permission denied

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:47:43

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:47:41 iris sshguard[84562]: Attack from "67.207.83.115" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:47:43

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:47:41 iris sshguard[84562]: Blocking "67.207.83.115/32" for 120 secs (3 attacks in 833 secs, after 1 abuses over 833 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:47:43

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:47:41 iris sshd[77909]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:48:11

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:48:11 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:51:28

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:51:27 iris sshguard[84562]: Attack from "67.207.83.115" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:51:28

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:51:27 iris sshguard[84562]: Attack from "67.207.83.115" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:51:28

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:51:27 iris sshguard[84562]: Blocking "67.207.83.115/32" for 240 secs (3 attacks in 0 secs, after 2 abuses over 1059 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:51:54

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:51:53 iris sshguard[84562]: Attack from "106.13.59.131" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:51:54

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:51:53 iris sshguard[84562]: Blocking "106.13.59.131/32" for 120 secs (3 attacks in 567 secs, after 1 abuses over 567 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:51:54

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:51:53 iris sshd[91367]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:55:37

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:55:36 iris sshguard[84562]: Attack from "162.241.193.116" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:55:37

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:55:36 iris sshguard[84562]: Blocking "162.241.193.116/32" for 120 secs (3 attacks in 1336 secs, after 1 abuses over 1336 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:55:37

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:55:36 iris sshd[26771]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:56:41

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:56:41 iris sshguard[84562]: Attack from "106.13.59.131" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:56:47

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:56:46 iris sshguard[84562]: Attack from "106.13.59.131" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:57:28

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:57:27 iris sshguard[84562]: Attack from "157.230.235.233" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:58:12

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:58:11 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:59:08

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:59:06 iris sshguard[84562]: Attack from "67.207.83.115" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:59:08

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:59:06 iris sshguard[84562]: Attack from "67.207.83.115" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:59:08

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:59:06 iris sshguard[84562]: Blocking "67.207.83.115/32" for 480 secs (3 attacks in 0 secs, after 3 abuses over 1518 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 08 09:59:22

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 11:59:22 iris sshguard[84562]: Attack from "162.241.193.116" on service 100 with danger 10.

 --END OF NOTIFICATION