Dec 9 04:15:19 prd-ubuntu1804-docker-8c-8g-18902 passwd[1029]: password for 'ubuntu' changed by 'root' Dec 9 04:15:19 prd-ubuntu1804-docker-8c-8g-18902 systemd-logind[1102]: Watching system buttons on /dev/input/event0 (Power Button) Dec 9 04:15:19 prd-ubuntu1804-docker-8c-8g-18902 systemd-logind[1102]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard) Dec 9 04:15:19 prd-ubuntu1804-docker-8c-8g-18902 systemd-logind[1102]: New seat seat0. Dec 9 04:15:19 prd-ubuntu1804-docker-8c-8g-18902 sshd[1227]: Server listening on 0.0.0.0 port 22. Dec 9 04:15:19 prd-ubuntu1804-docker-8c-8g-18902 sshd[1227]: Server listening on :: port 22. Dec 9 04:15:22 prd-ubuntu1804-docker-8c-8g-18902 sshd[1489]: Did not receive identification string from 10.30.104.4 port 57912 Dec 9 04:15:23 prd-ubuntu1804-docker-8c-8g-18902 sshd[1494]: Invalid user jenkins from 10.30.104.4 port 57920 Dec 9 04:15:23 prd-ubuntu1804-docker-8c-8g-18902 sshd[1494]: Received disconnect from 10.30.104.4 port 57920:11: Closed due to user request. [preauth] Dec 9 04:15:23 prd-ubuntu1804-docker-8c-8g-18902 sshd[1494]: Disconnected from invalid user jenkins 10.30.104.4 port 57920 [preauth] Dec 9 04:15:25 prd-ubuntu1804-docker-8c-8g-18902 sshd[1519]: Invalid user jenkins from 10.30.104.4 port 57972 Dec 9 04:15:25 prd-ubuntu1804-docker-8c-8g-18902 sshd[1519]: Received disconnect from 10.30.104.4 port 57972:11: Closed due to user request. [preauth] Dec 9 04:15:25 prd-ubuntu1804-docker-8c-8g-18902 sshd[1519]: Disconnected from invalid user jenkins 10.30.104.4 port 57972 [preauth] Dec 9 04:15:27 prd-ubuntu1804-docker-8c-8g-18902 sshd[1521]: Invalid user jenkins from 10.30.104.4 port 58020 Dec 9 04:15:27 prd-ubuntu1804-docker-8c-8g-18902 sshd[1521]: Received disconnect from 10.30.104.4 port 58020:11: Closed due to user request. [preauth] Dec 9 04:15:27 prd-ubuntu1804-docker-8c-8g-18902 sshd[1521]: Disconnected from invalid user jenkins 10.30.104.4 port 58020 [preauth] Dec 9 04:15:29 prd-ubuntu1804-docker-8c-8g-18902 sshd[1523]: Invalid user jenkins from 10.30.104.4 port 58056 Dec 9 04:15:29 prd-ubuntu1804-docker-8c-8g-18902 sshd[1523]: Received disconnect from 10.30.104.4 port 58056:11: Closed due to user request. [preauth] Dec 9 04:15:29 prd-ubuntu1804-docker-8c-8g-18902 sshd[1523]: Disconnected from invalid user jenkins 10.30.104.4 port 58056 [preauth] Dec 9 04:15:31 prd-ubuntu1804-docker-8c-8g-18902 sshd[1525]: Invalid user jenkins from 10.30.104.4 port 58094 Dec 9 04:15:31 prd-ubuntu1804-docker-8c-8g-18902 sshd[1525]: Received disconnect from 10.30.104.4 port 58094:11: Closed due to user request. [preauth] Dec 9 04:15:31 prd-ubuntu1804-docker-8c-8g-18902 sshd[1525]: Disconnected from invalid user jenkins 10.30.104.4 port 58094 [preauth] Dec 9 04:15:34 prd-ubuntu1804-docker-8c-8g-18902 sshd[1527]: Invalid user jenkins from 10.30.104.4 port 58146 Dec 9 04:15:34 prd-ubuntu1804-docker-8c-8g-18902 sshd[1527]: Received disconnect from 10.30.104.4 port 58146:11: Closed due to user request. [preauth] Dec 9 04:15:34 prd-ubuntu1804-docker-8c-8g-18902 sshd[1527]: Disconnected from invalid user jenkins 10.30.104.4 port 58146 [preauth] Dec 9 04:15:36 prd-ubuntu1804-docker-8c-8g-18902 sshd[1529]: Invalid user jenkins from 10.30.104.4 port 58196 Dec 9 04:15:36 prd-ubuntu1804-docker-8c-8g-18902 sshd[1529]: Received disconnect from 10.30.104.4 port 58196:11: Closed due to user request. [preauth] Dec 9 04:15:36 prd-ubuntu1804-docker-8c-8g-18902 sshd[1529]: Disconnected from invalid user jenkins 10.30.104.4 port 58196 [preauth] Dec 9 04:15:38 prd-ubuntu1804-docker-8c-8g-18902 sshd[1539]: Invalid user jenkins from 10.30.104.4 port 58238 Dec 9 04:15:38 prd-ubuntu1804-docker-8c-8g-18902 sshd[1539]: Received disconnect from 10.30.104.4 port 58238:11: Closed due to user request. [preauth] Dec 9 04:15:38 prd-ubuntu1804-docker-8c-8g-18902 sshd[1539]: Disconnected from invalid user jenkins 10.30.104.4 port 58238 [preauth] Dec 9 04:15:41 prd-ubuntu1804-docker-8c-8g-18902 sshd[1683]: Invalid user jenkins from 10.30.104.4 port 58266 Dec 9 04:15:41 prd-ubuntu1804-docker-8c-8g-18902 sshd[1683]: Received disconnect from 10.30.104.4 port 58266:11: Closed due to user request. [preauth] Dec 9 04:15:41 prd-ubuntu1804-docker-8c-8g-18902 sshd[1683]: Disconnected from invalid user jenkins 10.30.104.4 port 58266 [preauth] Dec 9 04:15:43 prd-ubuntu1804-docker-8c-8g-18902 sshd[1754]: Invalid user jenkins from 10.30.104.4 port 58306 Dec 9 04:15:43 prd-ubuntu1804-docker-8c-8g-18902 sshd[1754]: Received disconnect from 10.30.104.4 port 58306:11: Closed due to user request. [preauth] Dec 9 04:15:43 prd-ubuntu1804-docker-8c-8g-18902 sshd[1754]: Disconnected from invalid user jenkins 10.30.104.4 port 58306 [preauth] Dec 9 04:15:45 prd-ubuntu1804-docker-8c-8g-18902 sshd[1773]: Invalid user jenkins from 10.30.104.4 port 58340 Dec 9 04:15:45 prd-ubuntu1804-docker-8c-8g-18902 sshd[1773]: Received disconnect from 10.30.104.4 port 58340:11: Closed due to user request. [preauth] Dec 9 04:15:45 prd-ubuntu1804-docker-8c-8g-18902 sshd[1773]: Disconnected from invalid user jenkins 10.30.104.4 port 58340 [preauth] Dec 9 04:15:47 prd-ubuntu1804-docker-8c-8g-18902 sshd[1810]: Invalid user jenkins from 10.30.104.4 port 58358 Dec 9 04:15:47 prd-ubuntu1804-docker-8c-8g-18902 sshd[1810]: Received disconnect from 10.30.104.4 port 58358:11: Closed due to user request. [preauth] Dec 9 04:15:47 prd-ubuntu1804-docker-8c-8g-18902 sshd[1810]: Disconnected from invalid user jenkins 10.30.104.4 port 58358 [preauth] Dec 9 04:15:49 prd-ubuntu1804-docker-8c-8g-18902 sshd[1814]: Invalid user jenkins from 10.30.104.4 port 58380 Dec 9 04:15:49 prd-ubuntu1804-docker-8c-8g-18902 sshd[1814]: Received disconnect from 10.30.104.4 port 58380:11: Closed due to user request. [preauth] Dec 9 04:15:49 prd-ubuntu1804-docker-8c-8g-18902 sshd[1814]: Disconnected from invalid user jenkins 10.30.104.4 port 58380 [preauth] Dec 9 04:15:51 prd-ubuntu1804-docker-8c-8g-18902 sshd[1834]: Invalid user jenkins from 10.30.104.4 port 58408 Dec 9 04:15:51 prd-ubuntu1804-docker-8c-8g-18902 sshd[1834]: Received disconnect from 10.30.104.4 port 58408:11: Closed due to user request. [preauth] Dec 9 04:15:51 prd-ubuntu1804-docker-8c-8g-18902 sshd[1834]: Disconnected from invalid user jenkins 10.30.104.4 port 58408 [preauth] Dec 9 04:15:54 prd-ubuntu1804-docker-8c-8g-18902 sshd[1836]: Invalid user jenkins from 10.30.104.4 port 58432 Dec 9 04:15:54 prd-ubuntu1804-docker-8c-8g-18902 sshd[1836]: Received disconnect from 10.30.104.4 port 58432:11: Closed due to user request. [preauth] Dec 9 04:15:54 prd-ubuntu1804-docker-8c-8g-18902 sshd[1836]: Disconnected from invalid user jenkins 10.30.104.4 port 58432 [preauth] Dec 9 04:15:56 prd-ubuntu1804-docker-8c-8g-18902 sshd[1838]: Invalid user jenkins from 10.30.104.4 port 58488 Dec 9 04:15:56 prd-ubuntu1804-docker-8c-8g-18902 sshd[1838]: Received disconnect from 10.30.104.4 port 58488:11: Closed due to user request. [preauth] Dec 9 04:15:56 prd-ubuntu1804-docker-8c-8g-18902 sshd[1838]: Disconnected from invalid user jenkins 10.30.104.4 port 58488 [preauth] Dec 9 04:15:58 prd-ubuntu1804-docker-8c-8g-18902 sshd[1840]: Invalid user jenkins from 10.30.104.4 port 58532 Dec 9 04:15:58 prd-ubuntu1804-docker-8c-8g-18902 sshd[1840]: Received disconnect from 10.30.104.4 port 58532:11: Closed due to user request. [preauth] Dec 9 04:15:58 prd-ubuntu1804-docker-8c-8g-18902 sshd[1840]: Disconnected from invalid user jenkins 10.30.104.4 port 58532 [preauth] Dec 9 04:16:00 prd-ubuntu1804-docker-8c-8g-18902 sshd[1842]: Invalid user jenkins from 10.30.104.4 port 58566 Dec 9 04:16:00 prd-ubuntu1804-docker-8c-8g-18902 sshd[1842]: Received disconnect from 10.30.104.4 port 58566:11: Closed due to user request. [preauth] Dec 9 04:16:00 prd-ubuntu1804-docker-8c-8g-18902 sshd[1842]: Disconnected from invalid user jenkins 10.30.104.4 port 58566 [preauth] Dec 9 04:16:02 prd-ubuntu1804-docker-8c-8g-18902 sshd[1844]: Invalid user jenkins from 10.30.104.4 port 58594 Dec 9 04:16:02 prd-ubuntu1804-docker-8c-8g-18902 sshd[1844]: Received disconnect from 10.30.104.4 port 58594:11: Closed due to user request. [preauth] Dec 9 04:16:02 prd-ubuntu1804-docker-8c-8g-18902 sshd[1844]: Disconnected from invalid user jenkins 10.30.104.4 port 58594 [preauth] Dec 9 04:16:03 prd-ubuntu1804-docker-8c-8g-18902 CRON[1845]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 9 04:16:03 prd-ubuntu1804-docker-8c-8g-18902 CRON[1845]: pam_unix(cron:session): session closed for user root Dec 9 04:16:04 prd-ubuntu1804-docker-8c-8g-18902 sshd[1854]: Invalid user jenkins from 10.30.104.4 port 58632 Dec 9 04:16:04 prd-ubuntu1804-docker-8c-8g-18902 sshd[1854]: Received disconnect from 10.30.104.4 port 58632:11: Closed due to user request. [preauth] Dec 9 04:16:04 prd-ubuntu1804-docker-8c-8g-18902 sshd[1854]: Disconnected from invalid user jenkins 10.30.104.4 port 58632 [preauth] Dec 9 04:16:07 prd-ubuntu1804-docker-8c-8g-18902 sshd[1856]: Invalid user jenkins from 10.30.104.4 port 58678 Dec 9 04:16:08 prd-ubuntu1804-docker-8c-8g-18902 sshd[1856]: Received disconnect from 10.30.104.4 port 58678:11: Closed due to user request. [preauth] Dec 9 04:16:08 prd-ubuntu1804-docker-8c-8g-18902 sshd[1856]: Disconnected from invalid user jenkins 10.30.104.4 port 58678 [preauth] Dec 9 04:16:09 prd-ubuntu1804-docker-8c-8g-18902 sshd[1858]: Invalid user jenkins from 10.30.104.4 port 58718 Dec 9 04:16:09 prd-ubuntu1804-docker-8c-8g-18902 sshd[1858]: Received disconnect from 10.30.104.4 port 58718:11: Closed due to user request. [preauth] Dec 9 04:16:09 prd-ubuntu1804-docker-8c-8g-18902 sshd[1858]: Disconnected from invalid user jenkins 10.30.104.4 port 58718 [preauth] Dec 9 04:16:11 prd-ubuntu1804-docker-8c-8g-18902 sshd[1860]: Invalid user jenkins from 10.30.104.4 port 58750 Dec 9 04:16:11 prd-ubuntu1804-docker-8c-8g-18902 sshd[1860]: Received disconnect from 10.30.104.4 port 58750:11: Closed due to user request. [preauth] Dec 9 04:16:11 prd-ubuntu1804-docker-8c-8g-18902 sshd[1860]: Disconnected from invalid user jenkins 10.30.104.4 port 58750 [preauth] Dec 9 04:16:12 prd-ubuntu1804-docker-8c-8g-18902 useradd[1880]: new group: name=jenkins, GID=1001 Dec 9 04:16:12 prd-ubuntu1804-docker-8c-8g-18902 useradd[1880]: new user: name=jenkins, UID=1001, GID=1001, home=/home/jenkins, shell=/bin/bash Dec 9 04:16:12 prd-ubuntu1804-docker-8c-8g-18902 usermod[1887]: add 'jenkins' to group 'docker' Dec 9 04:16:12 prd-ubuntu1804-docker-8c-8g-18902 usermod[1887]: add 'jenkins' to shadow group 'docker' Dec 9 04:16:13 prd-ubuntu1804-docker-8c-8g-18902 sshd[1948]: Accepted publickey for jenkins from 10.30.104.4 port 58780 ssh2: RSA SHA256:V0799BjlU//1ruj1g81rY7MeNIJkwAJ0Kr3lNX3XaN4 Dec 9 04:16:13 prd-ubuntu1804-docker-8c-8g-18902 sshd[1948]: pam_unix(sshd:session): session opened for user jenkins by (uid=0) Dec 9 04:16:13 prd-ubuntu1804-docker-8c-8g-18902 systemd-logind[1102]: New session 2 of user jenkins. Dec 9 04:16:13 prd-ubuntu1804-docker-8c-8g-18902 systemd: pam_unix(systemd-user:session): session opened for user jenkins by (uid=0) Dec 9 04:17:01 prd-ubuntu1804-docker-8c-8g-18902 CRON[2523]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 9 04:17:01 prd-ubuntu1804-docker-8c-8g-18902 CRON[2524]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 9 04:17:01 prd-ubuntu1804-docker-8c-8g-18902 CRON[2524]: pam_unix(cron:session): session closed for user root Dec 9 04:17:01 prd-ubuntu1804-docker-8c-8g-18902 CRON[2523]: pam_unix(cron:session): session closed for user root Dec 9 04:18:01 prd-ubuntu1804-docker-8c-8g-18902 CRON[3079]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 9 04:18:01 prd-ubuntu1804-docker-8c-8g-18902 CRON[3079]: pam_unix(cron:session): session closed for user root Dec 9 04:19:01 prd-ubuntu1804-docker-8c-8g-18902 CRON[5968]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 9 04:19:01 prd-ubuntu1804-docker-8c-8g-18902 CRON[5968]: pam_unix(cron:session): session closed for user root Dec 9 04:20:01 prd-ubuntu1804-docker-8c-8g-18902 CRON[9465]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 9 04:20:01 prd-ubuntu1804-docker-8c-8g-18902 CRON[9465]: pam_unix(cron:session): session closed for user root Dec 9 04:20:40 prd-ubuntu1804-docker-8c-8g-18902 sudo: jenkins : TTY=unknown ; PWD=/w/workspace/integration-xtesting-security-docker-verify-master ; USER=root ; COMMAND=/bin/cp /var/log/auth.log /tmp Dec 9 04:20:40 prd-ubuntu1804-docker-8c-8g-18902 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)