Sshlockout SMTP Email Notifications keep coming randomly
-
Hi All,
I've enabled SMTP E-mail Notifications in the System > Advanced > Notifications Menu
pfSense version: 2.2
Back around March 10th, I was trying to ssh over vpn using putty but messed up logging in a few times
So my ip got locked out.
I deleted that entry from the sshlockout tables (Diagnostic > Tables) and resumed working.
I haven't needed to ssh to access the system again since then and there have been no other entries in the sshlockout tables.
Also ssh is only accessible from the local network or over vpn.But the weird thing is occasionally I still get exact same email notifications of the message below:
Subject: Cron root@pfsense/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 sshlockout
Body:
X-Cron-Env: <shell= bin="" sh="">X-Cron-Env: <path= etc:="" bin:="" sbin:="" usr="" sbin="">X-Cron-Env: <home= var="" log="">X-Cron-Env: <logname=root>X-Cron-Env: <user=root>sshlockout: 1 of 1 entries deleted.The odd thing is the pfsense box hasn't been consistent with these email notifications:
Fri, Mar 13, 2015 at 8:00 PM
Tue, Mar 17, 2015 at 2:00 PM
Tue, Mar 17, 2015 at 6:00 PM
Tue, Mar 17, 2015 at 8:00 PM
Wed, Mar 18, 2015 at 12:00 PM
Wed, Mar 18, 2015 at 4:00 PM
Fri, Mar 27, 2015 at 8:00 PM
Tue, Apr 7, 2015 at 6:00 PM
Tue, Apr 7, 2015 at 8:00 PM
Thu, Apr 9, 2015 at 6:00 PM
Fri, Apr 10, 2015 at 11:00 AM
Thu, Apr 16, 2015 at 8:00 PM
Fri, Apr 17, 2015 at 2:00 PM
Fri, Apr 17, 2015 at 4:00 PM
Tue, Apr 21, 2015 at 8:00 PM
Wed, Apr 22, 2015 at 12:00 PM
Wed, Apr 22, 2015 at 2:00 PM
Wed, Apr 22, 2015 at 4:00 PMUptime shows: "59 Days 05 Hours 18 Minutes 42 Seconds" as of April 22, So its not like the pfsense box is rebooting or anything. Nor am I getting back on the list.
A bit concerned that one event will trigger emails to forever send notifications randomly.</user=root></logname=root></home=></path=></shell=>/root@pfsense
-
Small bump.
I'd also like to add in that power cycling or rebooting pfsense doesn't help.
I delete the entry in the Diagnostic Tables: sshlockout and it gets removed. Refresh to double check its gone.
But after a few days its back, and the entry listed is always my laptop's vpn ip address.
So I'm pretty sure its entry coming back as I should't have anything that tries to SSH into pfsense in the background.The odd thing is I'm starting to notice a pattern with the email notifications. It starts whenever I log into the WebGUI. and sends notifications for that day and stops. Untill the next time I log into the WebGUI again. (Example Second to last messages I got were April 28. The last messages I got were May 14. In between that time I never logged back into the WebGui)
-
Anything show up in the fw logs if you setup logging a rule for all your rules?