localhost versucht ssh Verbindung alle fünf Minuten

[Gast123]

Hallo Leute,

beim heutigen durchsehen meiner /var/log/security ist mir folgendes aufgefallen:

Jul 10 08:04:44 hpsrv sshd[883]: Connection closed by 127.0.0.1
Jul 10 08:09:44 hpsrv sshd[2196]: Connection closed by 127.0.0.1
Jul 10 08:14:44 hpsrv sshd[3490]: Connection closed by 127.0.0.1
Jul 10 08:19:44 hpsrv sshd[4751]: Connection closed by 127.0.0.1
Jul 10 08:24:44 hpsrv sshd[6002]: Connection closed by 127.0.0.1
Jul 10 08:29:44 hpsrv sshd[7242]: Connection closed by 127.0.0.1
Jul 10 08:34:44 hpsrv sshd[8479]: Connection closed by 127.0.0.1
Jul 10 08:39:44 hpsrv sshd[9695]: Connection closed by 127.0.0.1
Jul 10 08:44:44 hpsrv sshd[10894]: Connection closed by 127.0.0.1
Jul 10 08:49:44 hpsrv sshd[12076]: Connection closed by 127.0.0.1
Jul 10 08:54:44 hpsrv sshd[13237]: Connection closed by 127.0.0.1
Jul 10 08:59:44 hpsrv sshd[14380]: Connection closed by 127.0.0.1

Da wird wohl versucht, alle 5 Minuten von der lokalen Maschine eine ssh Verbindung herzustellen.
LogLevel DEBUG gibt etwas mehr Info:

Jul 14 15:04:29 hpsrv sshd[10415]: Connection from 127.0.0.1 port 37896
Jul 14 15:04:29 hpsrv sshd[10415]: debug1: Client protocol version 2.0; client software version check_ssh_1.4.15
Jul 14 15:04:29 hpsrv sshd[10415]: debug1: no match: check_ssh_1.4.15
Jul 14 15:04:29 hpsrv sshd[10415]: debug1: Enabling compatibility mode for protocol 2.0
Jul 14 15:04:29 hpsrv sshd[10415]: debug1: Local version string SSH-2.0-OpenSSH_5.6
Jul 14 15:04:29 hpsrv sshd[10416]: debug1: permanently_set_uid: 74/74
Jul 14 15:04:29 hpsrv sshd[10416]: debug1: list_hostkey_types: ssh-rsa,ssh-dss
Jul 14 15:04:29 hpsrv sshd[10416]: debug1: SSH2_MSG_KEXINIT sent
Jul 14 15:04:29 hpsrv sshd[10416]: Connection closed by 127.0.0.1
[...]
Jul 14 15:09:29 hpsrv sshd[10517]: Connection from 127.0.0.1 port 48653
Jul 14 15:09:29 hpsrv sshd[10517]: debug1: Client protocol version 2.0; client software version check_ssh_1.4.15
Jul 14 15:09:29 hpsrv sshd[10517]: debug1: no match: check_ssh_1.4.15
Jul 14 15:09:29 hpsrv sshd[10517]: debug1: Enabling compatibility mode for protocol 2.0
Jul 14 15:09:29 hpsrv sshd[10517]: debug1: Local version string SSH-2.0-OpenSSH_5.6
Jul 14 15:09:29 hpsrv sshd[10518]: debug1: permanently_set_uid: 74/74
Jul 14 15:09:29 hpsrv sshd[10518]: debug1: list_hostkey_types: ssh-rsa,ssh-dss
Jul 14 15:09:29 hpsrv sshd[10518]: debug1: SSH2_MSG_KEXINIT sent
Jul 14 15:09:29 hpsrv sshd[10518]: Connection closed by 127.0.0.1

Wobei auffällt, dass der Port stets wechselt.
Was kann das sein, was da läuft?

MfG

Schard

 

[HeadCrash]

Hallo,

der Sourceport wird zufällig gewählt, von daher ist das normal.

...
client software version check_ssh_1.4.15
...

der Schippsel lässt auf Nagios oder etwas ähnliches schießen.

mfg
HeadCrash

 

[Gast123]

Jop, es ist Nagios.
Fehlalarm!

Danke dir.

MfG
Schard