Vesta Control Panel - Forum

Community Forum

Skip to content

Advanced search
  • Quick links
    • Main site
    • Github repo
    • Google Search
  • FAQ
  • Login
  • Register
  • Board index
  • Search

Search found 5 matches

Go to advanced search

Advanced search
Search found 5 matches • Page 1 of 1
by arsham
Wed Feb 15, 2017 1:02 pm
Forum: General Discussion
Topic: SSH Breach on a New Machine?
Replies: 8
Views: 10004

Re: SSH Breach on a New Machine?

Will do, thanks.
  • Jump to post
by arsham
Tue Feb 14, 2017 10:04 pm
Forum: General Discussion
Topic: SSH Breach on a New Machine?
Replies: 8
Views: 10004

Re: SSH Breach on a New Machine?

I did look through auth.log and only found my own successful login attempts. I was under the impression that when PermitRootLogin is set to no root connections would be dropped. But I'll presume this is normal from now.

Thank you for the replies.
  • Jump to post
by arsham
Tue Feb 14, 2017 7:48 pm
Forum: General Discussion
Topic: SSH Breach on a New Machine?
Replies: 8
Views: 10004

Re: SSH Breach on a New Machine?

Yes it was a fresh Vesta install right after Ubuntu 16.04.2 LTS image installation. I ran these: apt-get update apt-get upgrade curl -O http://vestacp.com/pub/vst-install.sh delgroup admin shutdown -r now bash vst-install.sh --nginx yes --apache yes --phpfpm no --vsftpd no --proftpd yes --exim yes -...
  • Jump to post
by arsham
Tue Feb 14, 2017 5:35 pm
Forum: General Discussion
Topic: SSH Breach on a New Machine?
Replies: 8
Views: 10004

Re: SSH Breach on a New Machine?

The password did contain special characters, Fail2Ban was also on to prevent brute forcing. I had since shut the system down, but could you tell based on the info I had provided, whether they had successfully logged into the machine? I did look at: sudo cat /var/log/auth.log | grep "Accepted passwor...
  • Jump to post
by arsham
Tue Feb 14, 2017 1:54 pm
Forum: General Discussion
Topic: SSH Breach on a New Machine?
Replies: 8
Views: 10004

SSH Breach on a New Machine?

Hi guys, I set a pretty strong password on my brand new setup yesterday. Today I see 2 root logins from China and one from Germany... can someone please look into this? ashm@cp:~$ sudo netstat -tnpa | grep 'ESTABLISHED.*sshd' [sudo] password for ashm: Proto Recv-Q Send-Q Local Address Foreign Addres...
  • Jump to post

Search found 5 matches • Page 1 of 1

Go to advanced search



  • Board index
  • All times are UTC
  • Delete all board cookies
  • The team
Powered by phpBB® Forum Software © phpBB Limited
*Original Author: Brad Veryard
*Updated to 3.2 by MannixMD
 

 

Login  •  Register

I forgot my password