Search found 5 matches
- Wed Feb 15, 2017 1:02 pm
- Forum: General Discussion
- Topic: SSH Breach on a New Machine?
- Replies: 8
- Views: 10004
Re: SSH Breach on a New Machine?
Will do, thanks.
- Tue Feb 14, 2017 10:04 pm
- Forum: General Discussion
- Topic: SSH Breach on a New Machine?
- Replies: 8
- Views: 10004
Re: SSH Breach on a New Machine?
I did look through auth.log and only found my own successful login attempts. I was under the impression that when PermitRootLogin is set to no root connections would be dropped. But I'll presume this is normal from now.
Thank you for the replies.
Thank you for the replies.
- Tue Feb 14, 2017 7:48 pm
- Forum: General Discussion
- Topic: SSH Breach on a New Machine?
- Replies: 8
- Views: 10004
Re: SSH Breach on a New Machine?
Yes it was a fresh Vesta install right after Ubuntu 16.04.2 LTS image installation. I ran these: apt-get update apt-get upgrade curl -O http://vestacp.com/pub/vst-install.sh delgroup admin shutdown -r now bash vst-install.sh --nginx yes --apache yes --phpfpm no --vsftpd no --proftpd yes --exim yes -...
- Tue Feb 14, 2017 5:35 pm
- Forum: General Discussion
- Topic: SSH Breach on a New Machine?
- Replies: 8
- Views: 10004
Re: SSH Breach on a New Machine?
The password did contain special characters, Fail2Ban was also on to prevent brute forcing. I had since shut the system down, but could you tell based on the info I had provided, whether they had successfully logged into the machine? I did look at: sudo cat /var/log/auth.log | grep "Accepted passwor...
- Tue Feb 14, 2017 1:54 pm
- Forum: General Discussion
- Topic: SSH Breach on a New Machine?
- Replies: 8
- Views: 10004
SSH Breach on a New Machine?
Hi guys, I set a pretty strong password on my brand new setup yesterday. Today I see 2 root logins from China and one from Germany... can someone please look into this? ashm@cp:~$ sudo netstat -tnpa | grep 'ESTABLISHED.*sshd' [sudo] password for ashm: Proto Recv-Q Send-Q Local Address Foreign Addres...