Support Support Downloads Knowledge Base Juniper Support Portal Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

Syslog message: Failed login attempts from host ‘ttyu0’ or ‘[unknown]’

0

0

Article ID: KB35986 KB Last Updated: 14 Jul 2020Version: 1.0
Summary:

This article explains the security logs which display failed login attempts from a host named ‘ttyu0’ or ‘[unknown]’.

Symptoms:

Error Log:

"%AUTH-5-LOGIN_FAILED: Login failed for user xyz: from host ttyu0"
Solution:

TTY is short for teletype, but it is popularly known as terminal. It is a device (implemented in software nowadays) that allows you to interact with the system by passing the data (you input) to the system, and displaying the output produced by the system.

TTYuN is the terminal corresponding to the device's serial ports, where N is the port number, starting from zero. If the terminal is connected to the first serial port, then the terminal will be TTYu0.

The ttyu0 you see in the below messages refers to the terminal on which the failed login attempt was made, not to the user who was trying to connect.

Log Set 1:
Oct 11 04:33:20.749 2019  login[75401]: LOGIN_FAILED: Login failed for user XX from host ttyu0
Oct 11 04:33:20.749 2019  login[75401]: Login attempt for user % Authentication failed from host [unknown]
Oct 11 04:31:19.776 2019  login[75381]: LOGIN_FAILED: Login failed for user password: from host ttyu0
Oct 11 04:31:19.776 2019  login[75381]: Login attempt for user % Authentication failed from host [unknown]

Host ttyu0 is referring to the serial terminal (console), not to an actual host, and [unknown] represents a general reference for a user not known by the system or the network.

On the other hand, considering the below logs:

Log Set 2:

Oct 15 14:43:55.810 2018 sshd: %AUTH-5-SSHD_LOGIN_FAILED: Login failed for user 'TEST' from host '192.168.1.1'
Oct 15 14:44:10.818 2019 sshd: %AUTH-5-SSHD_LOGIN_ATTEMPTS_THRESHOLD: Threshold for unsuccessful authentication attempts (3) reached by user 'TEST'

Here, the device detects an SSH attempt being made from user TEST and identifies the source as 192.168.1.1.

The above two log sets should have been able to establish when you are looking for the username and where you are looking for the device/port that the username is using when connecting to your device. Be careful when interpreting the logs because the terminal (interface or devices used to connect to the device) and the username used to authenticate on the device may be confused.

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search