Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Getty spamming log file .. another question

    Scheduled Pinned Locked Moved General pfSense Questions
    4 Posts 3 Posters 981 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      genic
      last edited by

      https://forum.pfsense.org/index.php?topic=32514.0

      question related to the post above..
      as stated in the post from 2011…i am on 2.1.2 nanobsd .. and this just started to happen when i plugged in my console cable to my console connection switch (MRV 00A909C-00308 model)

      i have yet to really configure my console connection switch for serial access to all of my network devices (and some servers), but i am curious...is this some sort of an attack? i am NOT allowing incoming connections for serial.

      attached is a snapshot of recent logs...(note: my root password is not set as the default one..and the password i use is 15+ chars long so i highly doubt anyone could run a bruteforce attack on it and get the right password...the password is unpronounceable language with special chars and uppper/lower case.)

      so..what is this...and why?
      it only stopped after i disconnected my cable from the console port (watchguard XTM 1050...anyone needing a box that can handle a huge amount of traffic..try to find one without the watchguard ios on it...and install amd64 nanobsd on it. load levels are at 0.15, 0.17, 0.12 currently..its a very nice peice of machinery...alas i digress)

      i searched, but what i found really didnt give me a solid answer for this issue. any suggestions?

      console_login_attempts.png
      console_login_attempts.png_thumb

      1 Reply Last reply Reply Quote 0
      • C
        charliem
        last edited by

        Generally this is caused by something sending data to the serial port while getty is running.  getty is expecting nothing but username/password pairs but seeing 'garbage' from your console switch.  This is  a unix thing, not a pfSense thing …

        I can't speak to the apparently successful logins shown in your logs.  Are you saying the logins are false positives, and you didn't really log in at those times?

        1 Reply Last reply Reply Quote 0
        • jimpJ
          jimp Rebel Alliance Developer Netgate
          last edited by

          It's probably the serial console constantly reloading the menu. When the menu reloads it shows as a login event. If getty is restarting, then it may be causing the menu to restart as well.

          Sometimes that can be due to a corrupt getty file or similar. I know we've offered suggestions for that one in the past here on the forum.

          Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

          Need help fast? Netgate Global Support!

          Do not Chat/PM for help!

          1 Reply Last reply Reply Quote 0
          • G
            genic
            last edited by

            @charliem:

            Generally this is caused by something sending data to the serial port while getty is running.  getty is expecting nothing but username/password pairs but seeing 'garbage' from your console switch.  This is  a unix thing, not a pfSense thing …

            I can't speak to the apparently successful logins shown in your logs.  Are you saying the logins are false positives, and you didn't really log in at those times?

            that is correct…i am NOT trying to login at any of those times, and NO ONE knows my password except myself, and console access from the outside is not allowed.

            since i unplugged my console switch....nada....

            i will look into the console switch config...

            1 Reply Last reply Reply Quote 0
            • First post
              Last post
            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.