Tomcat Hack Attempt: Attempt was made to authenticate the locked user

tomcat tomcat7 brute-force
DD. picture DD. · Jun 28, 2013 · Viewed 16k times · Source 
Jun 28, 2013 1:04:27 AM org.apache.catalina.realm.LockOutRealm authenticate
WARNING: An attempt was made to authenticate the locked user "admin"
Jun 28, 2013 1:04:27 AM org.apache.catalina.realm.LockOutRealm authenticate
WARNING: An attempt was made to authenticate the locked user "admin"
Jun 28, 2013 1:51:08 AM org.apache.catalina.realm.LockOutRealm authenticate
WARNING: An attempt was made to authenticate the locked user "tomcat"
Jun 28, 2013 1:51:55 AM org.apache.catalina.realm.LockOutRealm authenticate
WARNING: An attempt was made to authenticate the locked user "tomcat"
Jun 28, 2013 1:51:55 AM org.apache.catalina.realm.LockOutRealm authenticate
WARNING: An attempt was made to authenticate the locked user "tomcat"
Jun 28, 2013 1:52:36 AM org.apache.catalina.realm.LockOutRealm authenticate
WARNING: An attempt was made to authenticate the locked user "tomcat"
Jun 28, 2013 1:52:36 AM org.apache.catalina.realm.LockOutRealm authenticate
WARNING: An attempt was made to authenticate the locked user "tomcat"

I'm seeing several hundred attempts like the above. Is someone trying to hack my site? Should I be worried?

Answer

Olaf Kock picture Olaf Kock · Jun 28, 2013

Welcome to the internet. Your server most likely is connected to the internet, thus it will catch all kind of background noise. The smarter bots will try the standard accounts for the platform you're running, others will just blindly fire random requests.

Did something happen? Not in the lines that you have in this logfile - did the bots succeed in other cases? Who knows.

This is the reason why #1 in all hardening documents is: Eliminate default accounts. Unfortunately this is not yet #1 in all software development procedures, but there are less and less default accounts that could be used by this kind of exploits.

It also demonstrates nicely why you shouldn't have one of the 100 most popular passwords on easily guessable account names.

Related questions

How to set the context path of a web application in Tomcat 7.0

I know that I can rename my webapp (or it's WAR file) to ROOT but this is a terrible way to do it, IMHO. Now I checked out the tomcat doc & it says It is NOT recommended to place …

Read More
Tomcat 7 "SEVERE: A child container failed during start"

Basically, I've written a springMVC application (with a relatively shotgun my way first-timer approach with regards to Spring). The project works fine on Tomcat 6. My Tomcat server doesn't start and throws the following exception: Apr 29, 2012 3:41:00 PM org.apache.catalina.core.…

Read More
How to set level logging to DEBUG in Tomcat?

I would like to set level logging to DEBUG in tomcat but in console nevertheless only INFO and WARN output. Could anybody tell me what's wrong? My C:\tomcat\logging.properties: # Licensed to the Apache Software Foundation (ASF) under one …

Read More