1

I'm using Ubuntu 16.04 and running a small server on it. When I checked log files with grep -r 'ip-address' /var/log/ command, it returned this log

/var/log/auth.log:Dec 19 00:26:00 ip-10-xx-xx-xx sudo: adminuser : TTY=pts/1 ; PWD=/home/adminuser ; USER=root ; COMMAND=/bin/grep -r xx-xx-xx-xx(ipAddress) ./tomcat8 ./catalina.out ./install ./xvdf ./xvdg
/var/log/auth.log:Dec 19 00:26:00 ip-10-xx-xx-xx sudo: adminuser : TTY=pts/1 ; PWD=/home/adminuser ; USER=root ; COMMAND=/bin/grep -r xx-xx-xx-xx(ipAddress) /bin /boot /dev /etc /home /initrd.img /initrd.img.old /lib /lib64 /lost+found /media /mnt /opt /proc /root /run /sbin /snap /srv /sys /tmp /usr /var /vmlinuz /vmlinuz.old
/var/log/apache2/access.log.1:xx-xx-xx-xx(ipAddress) - - [18/Dec/2018:11:20:07 +0900] "\x16\x03\x01\x02" 400 0 "-" "-"
/var/log/apache2/access.log.1:xx-xx-xx-xx(ipAddress) - - [19/Dec/2018:05:52:37 +0900] "GET //recordings/ HTTP/1.1" 302 557 "-" "python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-862.14.4.el7.x86_64"

what does it means? Are they tried to login with adminuser as user name and run encrypt files below thees directories?

  • The two lines from auth.log look like they are caused by your grep command. – danzel Dec 19 '18 at 9:36
  • FWIW the 10.X.Y.Z address space is non-routable, ie it's from your own LAN, I'd guess it's the machine you're grepping from. Also "\x16\x03\x01\x02" appears to arise when someone tries to access using SSL a web server that's not using it, so they send https requests to a port that's serving http only. – pbhj Jan 12 at 21:06

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.