Authentication fail in syslog

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message
rnix
DD-WRT User


Joined: 23 Feb 2016
Posts: 80

PostPosted: Sat Dec 16, 2017 15:09    Post subject: Authentication fail in syslog Reply with quote
I have noticed those entries in my RT-N18U syslog lately.

Code:
Dec 16 01:40:46 Gateway user.info : Authentication fail
Dec 16 12:45:35 Gateway user.info : Authentication fail
Dec 16 15:04:49 Gateway user.info : Authentication fail


Does anyone have idea what could trigger those?
Sponsor
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 1911
Location: London,UK

PostPosted: Sat Dec 16, 2017 21:18    Post subject: Reply with quote
got something similar on my R7800 with the latest drivers
34085

Dec 15 16:18:47 R7800 user.info : Authentication fail
and one more at the end of the log
Dec 17 10:05:53 R7800 user.info : Authentication fail
it seems its related with wi-fi client

_________________
Atheros
TP-Link WR740Nv4 .......DD-WRT 33986 BS (AP,NAT,AD Blocking,Firewall)
TP-Link WR1043NDv2 ------DD-WRT 35874 BS (AP,PPPoE,NAT,AD Blocking,AP Isolation,Firewall)
TP-Link WR1043NDv2 ------DD-WRT 35927 BS (AP,NAT,AD Blocking,Firewall,No Wi-Fi)
TP-Link WR1043NDv2.......... Gargoyle OS 1.10 (AP,NAT,QoS,Quotas)
Qualcomm/IPQ8065
Netgear R7800 ------------DD-WRT 35965M Kong (AP,NAT,AD-Blocking,AP Isolation, Firewall,DNSCrypt x2)
Broadcom
Netgear R7000 ---------DD-WRT 35965 Kong (AP,NAT,AD-Blocking,AP Isolation, Firewall,DNSCrypt x4)
Others
Netgear ProSAFE-GS105Ev2 ....(LAN Switch)


Last edited by Alozaros on Sun Dec 17, 2017 8:11; edited 1 time in total
jxm
DD-WRT User


Joined: 23 Jul 2017
Posts: 276
Location: Brisbane, Australia

PostPosted: Sun Dec 17, 2017 0:42    Post subject: Re: Authentication fail in syslog Reply with quote
rnix wrote:
I have noticed those entries in my RT-N18U syslog lately.

Code:
Dec 16 01:40:46 Gateway user.info : Authentication fail
Dec 16 12:45:35 Gateway user.info : Authentication fail
Dec 16 15:04:49 Gateway user.info : Authentication fail


Does anyone have idea what could trigger those?


These would be unsuccessful attempts to access your router, you probably have turned on remote administration and so have a port open.

Logging would be turned on, to report failures.

These events are very common, if you have never seen them before it is because you have not looked.
rnix
DD-WRT User


Joined: 23 Feb 2016
Posts: 80

PostPosted: Sun Dec 17, 2017 4:58    Post subject: Reply with quote
I have remote admin disabled and I regularly check syslog.
Also failed webui login attemps are being reported differently: Dec 16 15:04:52 Gateway user.info : httpd login failure - bad passwd !
This is new started only with latest builds.
rnix
DD-WRT User


Joined: 23 Feb 2016
Posts: 80

PostPosted: Tue Dec 19, 2017 7:38    Post subject: Reply with quote
OK.
After some testing I have discovered that every time I successfully login to WebGUI, this "Authentication fail" entry is generated in Syslog. What gives?
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 1911
Location: London,UK

PostPosted: Tue Dec 19, 2017 12:15    Post subject: Reply with quote
same here i was thinking its wi fi client error but yep everytime i log in
its there ....
do you have any iptables restrictions regarding GUI access?

_________________
Atheros
TP-Link WR740Nv4 .......DD-WRT 33986 BS (AP,NAT,AD Blocking,Firewall)
TP-Link WR1043NDv2 ------DD-WRT 35874 BS (AP,PPPoE,NAT,AD Blocking,AP Isolation,Firewall)
TP-Link WR1043NDv2 ------DD-WRT 35927 BS (AP,NAT,AD Blocking,Firewall,No Wi-Fi)
TP-Link WR1043NDv2.......... Gargoyle OS 1.10 (AP,NAT,QoS,Quotas)
Qualcomm/IPQ8065
Netgear R7800 ------------DD-WRT 35965M Kong (AP,NAT,AD-Blocking,AP Isolation, Firewall,DNSCrypt x2)
Broadcom
Netgear R7000 ---------DD-WRT 35965 Kong (AP,NAT,AD-Blocking,AP Isolation, Firewall,DNSCrypt x4)
Others
Netgear ProSAFE-GS105Ev2 ....(LAN Switch)
rnix
DD-WRT User


Joined: 23 Feb 2016
Posts: 80

PostPosted: Tue Dec 19, 2017 16:15    Post subject: Reply with quote
Alozaros wrote:
same here i was thinking its wi fi client error but yep everytime i log in
its there ....
do you have any iptables restrictions regarding GUI access?

No custom iptables whatsoever.
I also confirm exact same behaviour with TL-WR740N v4 and this is Atheros hardware.
ginzon
DD-WRT User


Joined: 23 Jun 2014
Posts: 70

PostPosted: Mon Jan 01, 2018 16:18    Post subject: Reply with quote
Atheros hardware TL-WR740N v4


I'm getting the same message. Do note, I keep a regular check on the log for any failure.. This is the first time so I came looking for an answer Smile

_________________
TP-Link: TL-WR740N
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 1911
Location: London,UK

PostPosted: Mon Jan 01, 2018 19:26    Post subject: Reply with quote
there is nothing to worry about...,its just there from 2-3 builds ago...
_________________
Atheros
TP-Link WR740Nv4 .......DD-WRT 33986 BS (AP,NAT,AD Blocking,Firewall)
TP-Link WR1043NDv2 ------DD-WRT 35874 BS (AP,PPPoE,NAT,AD Blocking,AP Isolation,Firewall)
TP-Link WR1043NDv2 ------DD-WRT 35927 BS (AP,NAT,AD Blocking,Firewall,No Wi-Fi)
TP-Link WR1043NDv2.......... Gargoyle OS 1.10 (AP,NAT,QoS,Quotas)
Qualcomm/IPQ8065
Netgear R7800 ------------DD-WRT 35965M Kong (AP,NAT,AD-Blocking,AP Isolation, Firewall,DNSCrypt x2)
Broadcom
Netgear R7000 ---------DD-WRT 35965 Kong (AP,NAT,AD-Blocking,AP Isolation, Firewall,DNSCrypt x4)
Others
Netgear ProSAFE-GS105Ev2 ....(LAN Switch)
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum