CentOS - Apr 2013 - Audit logs source of account triggering it.

Hi.

The auditd logs are full of lines referencing 28756E6B6E6F776E207573657229
, but I can't identify this account

type=USER_LOGIN msg=audit(1364926580.306:249814): user pid=22565 uid=0
auid=4294967295 ses=4294967295 msg='op=login
acct=28756E6B6E6F776E207573657229 exe="/usr/sbin/sshd" hostname=?
addr=127.0.0.1 terminal=ssh res=failed'


What would typically cause this ? There are no other references in any of
the other logs to 28756E6B6E6F776E207573657229 and its to long for our
typical UID / GID .

Thanks

G

Am 08.04.2013 07:04, schrieb Gregory Machin:
> type=USER_LOGIN msg=audit(1364926580.306:249814): user pid=22565 uid=0
> auid=4294967295 ses=4294967295 msg='op=login
> acct=28756E6B6E6F776E207573657229 exe="/usr/sbin/sshd" hostname=?
> addr=127.0.0.1 terminal=ssh res=failed'
> 
> What would typically cause this ? There are no other references in any of
> the other logs to 28756E6B6E6F776E207573657229 and its to long for our
> typical UID / GID .
Looks like a hex dump of an ASCII string:

28756E6B6E6F776E207573657229
 ( u n k n o w n   u s e r )

HTH
T.

-- 
Tilman Schmidt
Phoenix Software GmbH
Bonn, Germany


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 261 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.centos.org/pipermail/centos/attachments/20130410/51882a0a/attachment.sig>