[lug] Something bad???-UPDATE!

[Scott A. Herod]

May not be your SSHD though.  I've seen a couple of reports of 
sshd based trojans.  Verify that you have the original versions
of ls, ps, netstat and lsof ( they are replaced in the attacks
that I've seen ) and check you system.  Also, look at

http://lists.insecure.org/incidents/2000/Sep/0214.html

Scott

Shannon Johnston wrote:
> 
> Sorry, I forgot to mention that it's SSHD producing this message.
> 
> > I've had this message run through my log file. What's going on here
> >
> >
> > >> Faking authloop for illegal user <user> from <IPADDR> port 61478
> >
> > Anybody know?
> >
> > Thanks,
> > Shannon Johnston