Ja hab ich auch schon angeschaut, ich finde nichts aussergewöhnliches - ausser dass nachts sehr viele Authentifizierungsfehler vorkommen. Hier mal einen Auszug davon:
Jun 8 00:32:15 mail sshd(pam_unix)[18185]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85-126-12-250.work.xdsl-line.inode.at
Jun 8 00:32:18 mail sshd(pam_unix)[18187]: check pass; user unknown
Jun 8 00:32:18 mail sshd(pam_unix)[18187]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85-126-12-250.work.xdsl-line.inode.at
Jun 8 00:32:22 mail sshd(pam_unix)[18197]: check pass; user unknown
Jun 8 00:32:22 mail sshd(pam_unix)[18197]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85-126-12-250.work.xdsl-line.inode.at
Jun 8 00:32:25 mail sshd(pam_unix)[18199]: check pass; user unknown
Jun 8 00:32:25 mail sshd(pam_unix)[18199]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85-126-12-250.work.xdsl-line.inode.at
Jun 8 00:32:28 mail sshd(pam_unix)[18201]: check pass; user unknown
Jun 8 00:32:28 mail sshd(pam_unix)[18201]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85-126-12-250.work.xdsl-line.inode.at
Jun 8 00:32:32 mail sshd(pam_unix)[18203]: check pass; user unknown
Jun 8 06:01:01 mail crond(pam_unix)[21585]: session opened for user root by (uid=0)
Jun 8 06:01:01 mail crond(pam_unix)[21585]: session closed for user root
Jun 8 06:15:02 mail crond(pam_unix)[21697]: session opened for user root by (uid=0)
Jun 8 06:15:02 mail crond(pam_unix)[21697]: session closed for user root
Jun 8 07:01:01 mail crond(pam_unix)[22070]: session opened for user root by (uid=0)
Jun 8 07:01:01 mail crond(pam_unix)[22070]: session closed for user root
Jun 8 07:15:01 mail crond(pam_unix)[22160]: session opened for user root by (uid=0)
Jun 8 07:15:01 mail crond(pam_unix)[22160]: session closed for user root
Jun 8 08:01:01 mail crond(pam_unix)[22799]: session opened for user root by (uid=0)
Jun 8 08:01:01 mail crond(pam_unix)[22799]: session closed for user root
Im Maillog habe ich noch was Sonderbares gesehen - ich habe jeweils eine Zeile mit der Authentifizierung und gleich anschliessend ein Logout meines Users, obwohl ich im Webmail immer noch angemeldet bin. Ist das normal?
Hier ein Auszug davon:
Jun 8 07:56:55 mail imapd[22708]: Authenticated user=huhu host=xyz [xyz]
Jun 8 07:56:55 mail imapd[22708]: Logout user=huhu host=xyz
Jun 8 07:56:56 mail imapd[22709]: Authenticated user=huhu host=xyz
Jun 8 07:56:56 mail imapd[22709]: Logout user=huhu host=xyz
Jun 8 07:57:25 mail imapd[22713]: Authenticated user=huhu host=xyz