Telnet login failed
advICE :Intrusions : 2001608

Summary

Multiple Telnet logon failures using bad user names and/or passwords.

Details

An intruder may be attempting to login repeatedly using different user names and passwords. You should ensure you have good passwords on all your remotely accessible services.

parametric information victim The IP address of the system on which the login attempt occurred. login The login name attempted.

configuration for this item login.telnet.count 4 The number of failed logins to trigger this intrusion detection. login.telnet.interval 3600 The time interval (in seconds) over which the login failures are measured. telnet.login LOGIN: The login string from the server (case is ignored). telnet.password PASSWORD: The password string from the server (case is ignored). telnet.failed INCORRECT The message from the server indicating that the login failed (case is ignored).

 
Version appeared: