“POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?

Unfortunately this in now a very common occurrence. It is an automated attack on SSH which is using ‘common’ usernames to try and break into your system. The message means exactly what it says, it does not mean that you have been hacked, just that someone tried.

Related Posts:

  1. Is it normal to get hundreds of break-in attempts per day?
  2. How to check if an RSA public / private key pair match
  3. how do you create an ssh key for another user?
  4. Show all users and their groups/vice versa
  5. No space left on device
  6. mysql_config not found when installing mysqldb python interface
  7. ssh: Could not resolve hostname [hostname]: nodename nor servname provided, or not known
  8. Pseudo-terminal will not be allocated because stdin is not a terminal
  9. X11 forwarding request failed on channel 0
  10. mysql_config not found when installing mysqldb python interface
  11. Pseudo-terminal will not be allocated because stdin is not a terminal
  12. How to download a file from server using SSH?
  13. Explanation of polkitd Unregistered Authentication Agent
  14. CentOS error – sudo: effective uid is not 0, is sudo installed setuid root?
  15. connect to host localhost port 22: Connection refused
  16. Getting stty: standard input: Inappropriate ioctl for device when using scp through an ssh tunnel
  17. httpd: Could not reliably determine the server’s fully qualified domain name, using 127.0.0.1 for ServerName
  18. EC2 ssh Permission denied (publickey,gssapi-keyex,gssapi-with-mic)
  19. How to configure WP filesystem access in Linux (Ubuntu Server)?
  20. WordPress sites being filled with random PHP files
  21. What permissions should my website files/folders have on a Linux webserver?
  22. Can I automatically add a new host to known_hosts?
  23. Can I nohup/screen an already-started process?
  24. When does `cron.daily` run?
  25. Permission denied (publickey). SSH from local Ubuntu to Amazon EC2 server
  26. How to reconnect to a disconnected ssh session
  27. how to disable SSH login with password for some users?
  28. Keeping a linux process running after I logout
  29. How to handle security updates within Docker containers?
  30. How can I verify if TLS 1.2 is supported on a remote web server from the RHEL/CentOS shell?
  31. Mount CIFS Host is down
  32. REJECT vs DROP when using iptables
  33. Allow SFTP but disallow SSH?
  34. Does getting disconnected from an SSH session kill your programs?
  35. Tips for Securing a LAMP Server
  36. Can you have more than one ~/.ssh/config file?
  37. How to add a security group to a running EC2 Instance?
  38. How bad is it really to install Linux on one big partition?
  39. SSH from A through B to C, using private key on B [closed]
  40. SSHFS mount that survives disconnect
  41. Heartbleed: how to reliably and portably check the OpenSSL version?
  42. Temporarily ignore my `~/.ssh/known_hosts` file?
  43. How can I fully log all bash scripts actions?
  44. What’s wrong with always being root?
  45. Hundreds of failed ssh logins
  46. protocol version mismatch — is your shell clean?
  47. How should an IT department choose a standard Linux distribution?
  48. What is the difference between /sbin/nologin and /bin/false?
  49. How do I grep recursively?
  50. Why do you need to put #!/bin/bash at the beginning of a script file?
  51. -bash: syntax error near unexpected token `newline’ for display command
  52. How do I use grep to search the current directory for all files having the a string “hello” yet display only .h and .cc files?
  53. SSH using python script
  54. Changing the resolution of a VNC session in linux
  55. Using putty to scp from windows to Linux
  56. How does “cat << EOF" work in bash?
  57. What is difference between arm64 and armhf?
  58. Implementing shell in C and need help handling input/output redirection
  59. How to count lines in a document?
  60. What does `set -x` do?
  61. How to get the process ID to kill a nohup process?
  62. Writing a simple shell in C using fork/execvp
  63. Implementation of multiple pipes in C
  64. chmod: changing permissions of ‘my_script.sh’: Operation not permitted
  65. Using ls to list directories and their total sizes
  66. tar: add all files and directories in current directory INCLUDING .svn and so on
  67. What does set -e mean in a bash script?
  68. make -j 8 g++: internal compiler error: Killed (program cc1plus)
  69. Pipe to/from the clipboard in a Bash script
  70. what does -zxvf mean in tar -zxvf filename? 
  71. Retrieve last 100 lines logs
  72. Linux Bash: Move multiple different files into same directory
  73. Configuring Apache for localhost
  74. how to search for a directory from the terminal in ubuntu
  75. Android – Command not found
  76. What does ‘bash -c’ do?
  77. How do I know the script file name in a Bash script?
  78. WordPress can’t find temporary folder, but folder it’s looking at has correct permissions
  79. Copying a large directory tree locally? cp or rsync?
  80. Check if port is open or closed on a Linux server?
  81. How to run a command multiple times, using bash shell?
  82. Should I quit using Ifconfig?
  83. SSL Certificate Location on UNIX/Linux
  84. What is “-bash: !”: event not found”
  85. Force dig to resolve without using cache
  86. How to forcibly close a socket in TIME_WAIT?
  87. Colors in bash after piping through less?
  88. Why does sudo command take long to execute?
  89. How can I export the privileges from MySQL and then import to a new server?
  90. Is there a directory equivalent of /dev/null in Linux?
  91. Can I send some text to the STDIN of an active process running in a screen session?
  92. How can I get processor/RAM/disk specs from the Linux command Line? [duplicate]
  93. Is there a way to see the execution tree of systemd?
  94. How to determine the hostname from an IP address in a Windows network?
  95. create home directories after create users
  96. How do I redirect subdomains to a different port on the same server?
  97. Running Cron every 2 hours [duplicate]
  98. How to check the physical status of an ethernet port in Linux?
  99. What does “debconf: delaying package configuration, since apt-utils is not installed” mean?
  100. In Linux, what is the difference between “buffers” and “cache” reported by the free command?

Leave a Comment