Should i worry ?

[Fred]

Hi guys,

We all know about the bots that scans sshd and try to brute force user or root password... It's common to receive 5 or 6 bfd alert every day for me :)
Some of us change the sshd port to avoid these scans...

But today, my logwatch mail was including a strange thing coming from one of these scans:
Jan 7 09:45:29 xxxxx sshd[21698]: User popa3d not allowed because shell /dev/ null is not executable

Does the "not allowed because shell /dev/null is not executable" means the password matched but the system wasn't able to start the shell ???

I mean, the normal message looks like this:
Jan 7 12:52:53 xxxxx sshd[898]: Failed password for illegal user popa3d from
xxx.xxx.xx.xxx port 1202 ssh2

So, should i worry ?

[Robert]

SSH login as the user popa3d is not possible. It might have been included in the error log because of an issue with the mail server (which is running as that user for certain tasks).

Ya should be fine.

[Fred]

thanks for your reply robert,
I didn't even though it could come from other service than sshd...

I should open my mind i guess... any suggestions for this ? :):)

[Robert]

Sorry, I'm not a mind doctor. Can't help there. (Though if I could, I could make more money doing that than fixing servers. lol)