Re: {bb} Protocol error

[Richard_Beals@tax.state.oh.us]

Mark,

Your management can be at ease.

That message from sshd says that a system opened a socket to port 22 but 
closed it without doing anything more... that is, there was no attempt to 
negotiate an SSH session. The "Big Brother" message is put there 
specifically so that you'll know where the connection originated from.

In other words, it's all working as designed.

If this is causing a non-green condition, you can instruct the BB client 
to ignore those messages (see bb-msgstab.DIST).

To prevent the message from being generated, you can stop monitoring sshd, 
but that is less than desirable (before you do, look up "bbrm" and 
"purple" in the BB docs).

--
Richard Beals -- Information Control Corporation (ICC)
eCommerce Systems Administrator
Ohio Department of Taxation
614-995-0891
614-598-1784 (cell)



"Mark Fenbers" <Mark.Fenbers@noaa.gov> 
Sent by: owner-bb@bb4.com
05/22/2006 08:37 AM
Please respond to
bb@bb4.com


To
bb@bb4.com
cc

Subject
{bb} Protocol error






I have BB-server installed on my box.  I don't yet have BB-client 
installed on other boxes, so BB-server is only checking 'conn', 'dns', 
and  'ssh'.  Even so, the /var/log/messages file on each of the clients 
is showing this error every five minutes:  "Bad protocol version 
identification 'Big-Brother-Monitor 1.9i' from  230.122.89.38".   My 
superiors are nervous about me proceeding to install the client portion 
until I get to the bottom of why this occurs.  Any ideas what it wrong 
and how I can rectify the issue?

Mark
--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=
To unsubscribe from this list, or to subscribe to the bb-digest list
send e-mail to mailto:majordomo@bb4.com with unsubscribe bb -and/or-
subscribe bb-digest in the BODY of the message.


--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=
To unsubscribe from this list, or to subscribe to the bb-digest list
send e-mail to mailto:majordomo@bb4.com with unsubscribe bb -and/or-
subscribe bb-digest in the BODY of the message.