Alert sshd(pam_unix)[17605]: check pass; user unknown

Unanswered Question
Feb 27th, 2009

Hi,

I get this message often in my syslog:

IPTel On Fri Feb 27 09:38:31 CET 2009 on node ditelcm1, the following SyslogSeverityMatchFound events generated: SeverityMatch - Alert sshd(pam_unix)[17605]: check pass; user unknown

What does it mean exactly?

Thanks,

Kurt

I have this problem too.
1 vote
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
irisrios Thu, 03/05/2009 - 06:39

This error generally means that somebody on the network is trying to access your CCM via SSH and it is failing. This could also be indicative of one of the administrators trying the wrong password a couple of times and eventually were logged in.

Ndudi Onwufor Mon, 02/22/2016 - 01:56
Hello Iris, I get the same message but please how do i get to the login details of the administrator. Thanks Ndudi
Deepak Rawat Mon, 02/22/2016 - 02:29

You will need to pull Audit logs from RTMT in order to find out the details. Refer to below links for more details:

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/service/7_1_2/ad...

https://supportforums.cisco.com/discussion/10853871/how-see-access-log-c...

Please note the above logs will only show you the detailed information if set to debug. In case, if they are not as of now then probably you might not be able to see the required information

Regards

Deepak

Actions

This Discussion