I got a warning from Fix Common Problems:

"**** Possible Hack Attempt on Jan 31 ****"

I checked and it said that there had been 22 failed attempts to login!  I checked the sys log and it only says:

"Feb  1 04:41:00 Tower root: Fix Common Problems: Error: Possible Hack Attempt on Jan 31"

I have Google fiber so my router is the Google network box.  The server is not on the internet, only on the local NAT network.

I run a bunch of anti-Virus programs and have never seen anything remotely threatening.

The warning has not been repeated, only that one time.

Any ideas what this could be?

tower-diagnostics-20190201-1112.zip

From your own network

 

FCP has a threshhold of 10 invalid per day before it triggers the alert.  This can be changed in its settings

 

Jan 31 15:36:54 Tower in.telnetd[32306]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:36:54 Tower telnetd[32306]: ttloop: peer died: EOF
Jan 31 15:36:54 Tower in.telnetd[32311]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:36:54 Tower in.telnetd[32325]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:36:54 Tower login[32332]: invalid password for 'root'  on '/dev/pts/0' from '192.168.1.7'
Jan 31 15:36:57 Tower in.telnetd[32435]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:36:57 Tower login[32436]: invalid password for 'root'  on '/dev/pts/1' from '192.168.1.7'
Jan 31 15:37:00 Tower in.telnetd[32566]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:00 Tower login[32567]: invalid password for 'root'  on '/dev/pts/0' from '192.168.1.7'
Jan 31 15:37:03 Tower in.telnetd[309]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:03 Tower login[310]: invalid password for 'UNKNOWN'  on '/dev/pts/0' from '192.168.1.7'
Jan 31 15:37:06 Tower in.telnetd[443]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:06 Tower login[444]: invalid password for 'root'  on '/dev/pts/0' from '192.168.1.7'
Jan 31 15:37:09 Tower in.telnetd[576]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:10 Tower login[577]: invalid password for 'root'  on '/dev/pts/0' from '192.168.1.7'
Jan 31 15:37:13 Tower in.telnetd[663]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:13 Tower login[664]: invalid password for 'root'  on '/dev/pts/1' from '192.168.1.7'
Jan 31 15:37:16 Tower in.telnetd[796]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:16 Tower login[797]: invalid password for 'root'  on '/dev/pts/0' from '192.168.1.7'
Jan 31 15:37:19 Tower in.telnetd[928]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:19 Tower login[929]: invalid password for 'root'  on '/dev/pts/0' from '192.168.1.7'
Jan 31 15:37:22 Tower in.telnetd[1060]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:22 Tower login[1061]: invalid password for 'root'  on '/dev/pts/1' from '192.168.1.7'
Jan 31 15:37:25 Tower in.telnetd[1193]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:25 Tower login[1195]: invalid password for 'UNKNOWN'  on '/dev/pts/0' from '192.168.1.7'
Jan 31 15:37:28 Tower in.telnetd[1319]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:28 Tower login[1326]: invalid password for 'root'  on '/dev/pts/0' from '192.168.1.7'
Jan 31 15:37:31 Tower in.telnetd[1434]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:31 Tower login[1435]: invalid password for 'UNKNOWN'  on '/dev/pts/0' from '192.168.1.7'
Jan 31 15:37:34 Tower in.telnetd[1575]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:34 Tower login[1576]: invalid password for 'root'  on '/dev/pts/0' from '192.168.1.7'
Jan 31 15:37:37 Tower in.telnetd[1704]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:37 Tower login[1705]: invalid password for 'root'  on '/dev/pts/0' from '192.168.1.7'
Jan 31 15:37:40 Tower in.telnetd[1837]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:40 Tower login[1838]: invalid password for 'UNKNOWN'  on '/dev/pts/0' from '192.168.1.7'
Jan 31 15:37:43 Tower in.telnetd[1965]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:43 Tower login[1966]: invalid password for 'UNKNOWN'  on '/dev/pts/0' from '192.168.1.7'
Jan 31 15:37:46 Tower in.telnetd[2054]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:46 Tower login[2055]: invalid password for 'root'  on '/dev/pts/0' from '192.168.1.7'
Jan 31 15:37:49 Tower in.telnetd[2182]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:49 Tower login[2183]: invalid password for 'UNKNOWN'  on '/dev/pts/0' from '192.168.1.7'
Jan 31 15:37:52 Tower in.telnetd[2313]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:52 Tower login[2314]: invalid password for 'root'  on '/dev/pts/0' from '192.168.1.7'
Jan 31 15:37:55 Tower in.telnetd[2442]: connect from 192.168.1.7 (192.168.1.7)
Jan 31 15:37:55 Tower login[2443]: invalid password for 'UNKNOWN'  on '/dev/pts/1' from '192.168.1.7'

 

Huh?  This is one of my FireTV boxes.  I am running Kodi on the box and it uses mysql database running on the unRaid server.  But I don't recall any reason for it to be trying to login as root.  Oh, well. Thanks for the help, anyway.

5 hours ago, CaptainTivo said:

Huh?  This is one of my FireTV boxes.  I am running Kodi on the box and it uses mysql database running on the unRaid server.  But I don't recall any reason for it to be trying to login as root.  Oh, well. Thanks for the help, anyway.

You might want to check to see if the FireTV box has been hacked...