Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a linux server running under a windows virtualbox. I use ssh with publickey to login, and use lftp's sftp feature for file transfer, which also use publickey.

Today when I check the log file, there is something making me very confused:

Nov 28 21:39:06 soft-server sshd[11933]: Accepted publickey for myusername from 10.0.2.2 port 50590 ssh2 Nov 28 21:39:06 soft-server sshd[11933]: pam_unix_session(sshd:session): session opened for user myusername by (uid=0)

Nov 28 21:39:25 soft-server sshd[11946]: Accepted password for myusername from 10.0.2.2 port 13494 ssh2

Nov 28 21:39:25 soft-server sshd[11946]: pam_unix_session(sshd:session): session opened for user myusername by (uid=0)

Nov 28 21:39:25 soft-server sshd[11948]: subsystem request for sftp by user myusername

Nov 28 21:40:16 soft-server sshd[11935]: Received disconnect from 10.0.2.2: 11: disconnected by user

Nov 28 21:40:16 soft-server sshd[11933]: pam_unix_session(sshd:session): session closed for user myusername

How can I suddenly use password to login? Is there any possibility that my own operation makes this behavior happens?

share|improve this question

migrated from stackoverflow.com Dec 18 '11 at 9:10

This question came from our site for professional and enthusiast programmers.

    
"myusername" is not my actual username, my username is not common. I just use "myusername" for replacement. –  M. Tong Dec 18 '11 at 8:47
add comment

2 Answers

Well, that's a legit sftp-via-ssh connection from your IP address. Either you've been keylogged, or (more likely in my opinion) you forgot that you set up password-based sftp for some application like DreamWeaver which is automatically logging in to your virtual host to keep its file repository up to date.

share|improve this answer
add comment

Looks like you've been hacked because you use a common username/password combination pair like myusername/mypassword.

You should

  1. ASAP change your password/username to a smth like mynEwp@$$_2011foobar
  2. check your root password too
  3. review shell history / system logs and inspect what commands was performed by hacked account
  4. rebind sshd to a non-default port, like 41022

the last action gives you some level of protection from automated 'worms' and 'bots'. They usually try to connect to default ports only.

PS: you can also try to entirely disable password-based authentication. Especially if it's not a problem for you to obtain a physical access to your server console.

share|improve this answer
1  
OMG you totally hackz0red his password! –  Cody Gray Dec 18 '11 at 8:45
    
Thanks. But this is not my actual username, my username is not common. I just use "myusername" for replacement. –  M. Tong Dec 18 '11 at 8:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.