SSH: Failed password for invalid user cacti from 127.0.0.1

[brononius]

At first sight, my cacti is running perfectly. Except 1 thing, some syslogs...
When i check this, i see a lot fo fails regarding passwords.
Any idea why he's doing this? Or better what i can do to resolve this?

2012-01-26 07:15:06 sshd[22129]: Failed password for invalid user cacti from 127.0.0.1 port 41150 ssh2 Auth Info
2012-01-26 07:15:06 sshd[22129]: Failed password for invalid user cacti from 127.0.0.1 port 41150 ssh2 Auth Info
2012-01-26 07:15:06 sshd[22129]: Failed password for invalid user cacti from 127.0.0.1 port 41150 ssh2 Auth Info
2012-01-26 07:15:06 sshd[22129]: Failed none for invalid user cacti from 127.0.0.1 port 41150 ssh2 Auth Info
2012-01-26 07:15:06 sshd[22129]: Invalid user cacti from 127.0.0.1 Auth Info
2012-01-26 07:15:01 /USR/SBIN/CRON[21853]: (www-data) CMD (php /usr/share/cacti/site/poller.php >/dev/null 2>/var/log/cacti/poller-error.log) Cron Info
2012-01-26 07:10:06 sshd[19475]: Failed password for invalid user cacti from 127.0.0.1 port 34336 ssh2 Auth Info
2012-01-26 07:10:06 sshd[19475]: Failed password for invalid user cacti from 127.0.0.1 port 34336 ssh2 Auth Info
2012-01-26 07:10:06 sshd[19475]: Failed password for invalid user cacti from 127.0.0.1 port 34336 ssh2 Auth Info
2012-01-26 07:10:06 sshd[19475]: Failed none for invalid user cacti from 127.0.0.1 port 34336 ssh2 Auth Info
2012-01-26 07:10:06 sshd[19475]: Invalid user cacti from 127.0.0.1 Auth Info
2012-01-26 07:10:01 /USR/SBIN/CRON[18849]: (www-data) CMD (php /usr/share/cacti/site/poller.php >/dev/null 2>/var/log/cacti/poller-error.log) Cron Info
2012-01-26 07:05:07 sshd[16420]: Failed password for invalid user cacti from 127.0.0.1 port 47741 ssh2 Auth Info
2012-01-26 07:05:07 sshd[16420]: Failed password for invalid user cacti from 127.0.0.1 port 47741 ssh2 Auth Info
2012-01-26 07:05:07 sshd[16420]: Failed password for invalid user cacti from 127.0.0.1 port 47741 ssh2 Auth Info
2012-01-26 07:05:07 sshd[16420]: Invalid user cacti from 127.0.0.1 Auth Info
2012-01-26 07:05:07 sshd[16420]: Failed none for invalid user cacti from 127.0.0.1 port 47741 ssh2 Auth Info
2012-01-26 07:05:01 /USR/SBIN/CRON[16215]: (www-data) CMD (php /usr/share/cacti/site/poller.php >/dev/null 2>/var/log/cacti/poller-error.log) Cron Info
2012-01-26 07:00:06 sshd[13907]: Failed password for invalid user cacti from 127.0.0.1 port 41360 ssh2 Auth Info
2012-01-26 07:00:06 sshd[13907]: Failed password for invalid user cacti from 127.0.0.1 port 41360 ssh2 Auth Info
2012-01-26 07:00:06 sshd[13907]: Failed password for invalid user cacti from 127.0.0.1 port 41360 ssh2 Auth Info
2012-01-26 07:00:06 sshd[13907]: Invalid user cacti from 127.0.0.1 Auth Info
2012-01-26 07:00:06 sshd[13907]: Failed none for invalid user cacti from 127.0.0.1 port 41360 ssh2 Auth Info
2012-01-26 07:00:01 /USR/SBIN/CRON[13340]: (www-data) CMD (php /usr/share/cacti/site/poller.php >/dev/null 2>/var/log/cacti/poller-error.log) Cron Info
2012-01-26 06:55:06 sshd[11177]: Failed password for invalid user cacti from 127.0.0.1 port 34

Thanks!!!

[doiggl]

Hello
Passwords must match in these areas.
Glenn


# mysql -u cacti -pcactipw -b cactidb
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 422
Server version: 5.5.16-log Source distribution

Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>

Also

# cat cacti/include/config.php
<?php
/*
+-------------------------------------------------------------------------+
| Copyright (C) 2004-2011 The Cacti Group |
| |
| This program is free software; you can redistribute it and/or |
| modify it under the terms of the GNU General Public License |
| as published by the Free Software Foundation; either version 2 |
| of the License, or (at your option) any later version. |
| |
| This program is distributed in the hope that it will be useful, |
| but WITHOUT ANY WARRANTY; without even the implied warranty of |
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| GNU General Public License for more details. |
+-------------------------------------------------------------------------+
| Cacti: The Complete RRDTool-based Graphing Solution |
+-------------------------------------------------------------------------+
| This code is designed, written, and maintained by the Cacti Group. See |
| about.php and/or the AUTHORS file for specific developer information. |
+-------------------------------------------------------------------------+
| http://www.cacti.net/ |
+-------------------------------------------------------------------------+
*/

/* make sure these values refect your actual database/host/user/password */
$database_type = "mysql";
$database_default = "cactidb";
$database_hostname = "localhost";
$database_username = "cacti";
$database_password = "cactipw";
$database_port = "3306";
$database_ssl = false;


Should see some results from a query, eg.

mysql> show tables;
+--------------------------------+
| Tables_in_cactidb |
+--------------------------------+
| cdef |
| cdef_items |
| colors |
| data_input |
| data_input_data |
| data_input_fields |
| data_local |
| data_template |
| data_template_data |
| data_template_data_rra |
| data_template_rrd |
| graph_local |
| graph_template_input |
| graph_template_input_defs |
| graph_templates |
| graph_templates_gprint |
| graph_templates_graph |
| graph_templates_item |
| graph_tree |
| graph_tree_items |
| host |
| host_graph |
| host_snmp_cache |
| host_snmp_query |
| host_template |
| host_template_graph |
| host_template_snmp_query |
| plugin_autom8_graph_rule_items |
| plugin_autom8_graph_rules |
| plugin_autom8_match_rule_items |
| plugin_autom8_tree_rule_items |
| plugin_autom8_tree_rules |
| plugin_config |
| plugin_db_changes |
| plugin_hooks |
| plugin_realms |
| poller |
| poller_command |
| poller_item |
| poller_output |
| poller_reindex |
| poller_time |
| rra |
| rra_cf |
| settings |
| settings_graphs |
| settings_tree |
| snmp_query |
| snmp_query_graph |
| snmp_query_graph_rrd |
| snmp_query_graph_rrd_sv |
| snmp_query_graph_sv |
| user_auth |
| user_auth_perms |
| user_auth_realm |
| user_log |
| version |
+--------------------------------+
57 rows in set (0.01 sec)

[brononius]

Seems fine...


mysql -u cacti -p cacti
password: xxxxxx

Code: Select all

Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 23339
Server version: 5.0.67-0ubuntu6.1 (Ubuntu)

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> show tables;
+--------------------------------+
| Tables_in_cacti                |
+--------------------------------+
| cdef                           | 
| cdef_items                     | 
| colors                         | 
.............<knip>..........................
| weathermap_groups              | 
| weathermap_maps                | 
| weathermap_settings            | 
+--------------------------------+
114 rows in set (0.00 sec)

cat /usr/share/cacti/site/include/config.php

Code: Select all

$database_type = "mysql";
$database_default = "cacti";
$database_hostname = "localhost";
$database_username = "cacti";
$database_password = "xxxxxx";
$database_port = "3306";
$database_ssl = false;

Cacti itself is working perfectly. My graphs, plugins... are working great at first sight.
Only the errors in the syslog seems a bit strange to me.
Also it's bizar that each time, he tries another port...

[doiggl]

I also had some other setup to do, via some .sql

# cat cacti-setup.sql
use mysql;
drop database if exists cactidb;
create database cactidb;
show databases;
grant all on cactidb.* TO cacti@localhost IDENTIFIED BY 'cacti';
flush privileges;
exit