Strange log !!!

[gothax]

Hello,
I install subsonic on my NAS synology (411Slim) with java 7. It 's work fine but my log have this strange message every 10 sec !

Code: Select all

...
[6/3/12 5:51:02 PM GMT+01:00]   INFO   RESTRequestParameterProcessingFilter   Authentication failed for user gothax
[6/3/12 5:56:21 PM GMT+01:00]   INFO   RESTRequestParameterProcessingFilter   Authentication failed for user gothax
[6/3/12 6:01:36 PM GMT+01:00]   INFO   RESTRequestParameterProcessingFilter   Authentication failed for user gothax
[6/3/12 6:08:04 PM GMT+01:00]   INFO   RESTRequestParameterProcessingFilter   Authentication failed for user gothax
[6/3/12 6:11:48 PM GMT+01:00]   INFO   RESTRequestParameterProcessingFilter   Authentication failed for user gothax
[6/3/12 6:11:59 PM GMT+01:00]   INFO   RESTRequestParameterProcessingFilter   Authentication failed for user gothax
[6/3/12 6:12:09 PM GMT+01:00]   INFO   RESTRequestParameterProcessingFilter   Authentication failed for user gothax
[6/3/12 6:12:20 PM GMT+01:00]   INFO   RESTRequestParameterProcessingFilter   Authentication failed for user gothax
[6/3/12 6:15:05 PM GMT+01:00]   INFO   RESTRequestParameterProcessingFilter   Authentication failed for user gothax
...
[6/3/12 6:27:56 PM GMT+01:00]   INFO   RESTRequestParameterProcessingFilter   Authentication failed for user gothax
[6/3/12 6:28:06 PM GMT+01:00]   INFO   RESTRequestParameterProcessingFilter   Authentication failed for user gothax
[6/3/12 6:28:17 PM GMT+01:00]   INFO   RESTRequestParameterProcessingFilter   Authentication failed for user gothax
[6/3/12 6:28:28 PM GMT+01:00]   INFO   RESTRequestParameterProcessingFilter   Authentication failed for user gothax
[6/3/12 6:28:39 PM GMT+01:00]   INFO   RESTRequestParameterProcessingFilter   Authentication failed for user gothax
[6/3/12 6:29:12 PM GMT+01:00]   INFO   RESTRequestParameterProcessingFilter   Authentication failed for user gothax
[6/3/12 6:30:42 PM GMT+01:00]   INFO   RESTRequestParameterProcessingFilter   Authentication failed for user gothax
...


But i can connect subsonic with my account gothax
Can you help me ???
Thx a lot !

[BKKKPewsey]

I assume you have read viewtopic.php?f=2&t=9202

[gothax]

Thx a lot but i put java 1.6 and it is the same problem

[GJ51]

Delete user "gothax".

[muvipix]

I have this same exact problem, except mine says ... "user ron" - I don't have a user ron to delete; although my server subdomain is ron. I've tried all the recommendations after searching for the terms and it's still happening. What's causing it?

[muvipix]

Anyone have any idea?

[sindre_mehus]

These requests comes from one of the Subsonic apps. Either an app you have installed yourself and forgotten about, or maybe some other user somewhere has once used the ron.subsonic.org domain name and not updated his app settings.

To avoid it, change the xxx.subsonic.org domain name in Settings > Network.

Cheers,
Sindre

[muvipix]

Thanks very much!

[muvipix]

Hm, changed the sub-domain name (restarted server) and it's still happening?

I cannot figure out what's causing it?

Edit: Let me add that I unchecked the "Access your server over the Internet using an easy-to-remember address." and it's still happening?

[bushman4]

Someone on a remote client (android, iphone, something) has your server set up by ip address on their client, with the username ron and no (or a wrong) password.

Only thing I can think of is to try to find out their IP address (in Windows, type "Netstat" at a command prompt and look for connections to your subsonic port) and block that IP address from connecting, either at the server or at the border router.

HTH,

Glenn

[muvipix]

and block that IP address from connecting, either at the server or at the border router.

This is easier said than done. I don't think my router supports it, does Windows FIrewall? Can't seem to find a definitive answer with a search. I can see the IP source, but it changed from somewhere in Tenn, US yesterday to Toledo, Ohio today. So I'm thinking it's server specific and not actually an individual. Or I could be wrong there, not really up on this. I've never had a user ron (especially lower case) before, so I was certainly wondering if it's just some hacker [script or otherwise] somewhere - obviously knowing the sub-domain server name. It's just weird how the attempts are variable time-wise!

[bushman4]

Then just ignore it, and don't create a user named ron in the future...

Glenn

[muvipix]

Then just ignore it, and don't create a user named ron in the future...

Glenn

You're kidding, right? This is the solution?

[bushman4]

What would you like for a solution? What do you envision the perfect solution to be?

I can see a few possible:

• An option to stop logging failed logins to the log file? - I for one would like to see failed logins under most circumstances, and would forget to turn this option back on before a problem where I needed the failure records crops up
• An option to not log failed logins from a particular username? - You already said you have no user named ron, so this one would be tough
• An option to block access from a particular client? - Since this client is changing IP addresses (probably a roaming data client hopping from tower to tower) this would be real tough too.
• An option to send a signal from the server to the client to say "Stop bothering me!"? - Good in principal (except that the client can't authenticate, so how can it get ANY response?) but would require a change to the server and the client, and good luck forcing this unknown remote client to upgrade.

Think about it... how would YOU implement a solution to this problem? I can't see a way.

Sorry, but I'm a realist in cases like these... "There are seldom good technological solutions for behavioral problems."

Glenn

[muvipix]

Touche, I guess "solution" was kind of final.

You could have said you had no idea

Now I'm kidding.

You make good points. However, I performed a search here in the forum and, for the most part, everyone was taking guesses as to what the problem might be - I tried them all anyway. Obviously, whatever IT is - as you mentioned - it knows my IP because it continues after I turn off the redirect. I did "share" a couple of tracks on Facebook ions ago (probably a year ago or so) and if I remember correctly, IPs are visible with that feature, but I don't think it would be the same IP today; possible, but not probable.

It's just annoying, Glenn. I'm fairly certain that if you had the problem (or anyone else), you'd want it to stop. Am I correct?

I thank you for trying!