anything i can do: error: Could not get shadow information for NOUSER

[sander815]

everyday i see this LARGE log file in my mail
can i do anything about this?

User ftp not allowed because not listed in AllowUsers
error: Could not get shadow information for NOUSER
Failed password for invalid user ftp from 220.134.68.142 port 41496 ssh2
User mysql not allowed because account is locked
error: Could not get shadow information for NOUSER
Failed password for invalid user mysql from 220.134.68.142 port 41658 ssh2
Invalid user postfix from 220.134.68.142
error: Could not get shadow information for NOUSER
Failed password for invalid user postfix from 220.134.68.142 port 41719 ssh2
Invalid user testuser from 220.134.68.142
error: Could not get shadow information for NOUSER
Failed password for invalid user testuser from 220.134.68.142 port 41811 ssh2
etc etc etc

 

[jmstacey]

It appears to be scans to attempt hacking. I would suggest simply blocking that IP or block temporarily.

 

[sander815]

well, there are a lot ips, they vary every day..

 

[nobaloney]

You can find and delete the cronjob that's scanning the logs and sending you the email.

Since that could very from setup to setup and from OS to OS I can't really tell you what to delete or change to do that.

Jeff

 

[sander815]

its not so bad i get the email, but what are they trying?

 

[jmstacey]

I made my guess in the first post I made to this thread.