Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a linux server running under a windows virtualbox. I use ssh with publickey to login, and use lftp's sftp feature for file transfer, which also use publickey.

Today when I check the log file, there is something making me very confused:

Nov 28 21:39:06 soft-server sshd[11933]: Accepted publickey for myusername from 10.0.2.2 port 50590 ssh2 Nov 28 21:39:06 soft-server sshd[11933]: pam_unix_session(sshd:session): session opened for user myusername by (uid=0)

Nov 28 21:39:25 soft-server sshd[11946]: Accepted password for myusername from 10.0.2.2 port 13494 ssh2

Nov 28 21:39:25 soft-server sshd[11946]: pam_unix_session(sshd:session): session opened for user myusername by (uid=0)

Nov 28 21:39:25 soft-server sshd[11948]: subsystem request for sftp by user myusername

Nov 28 21:40:16 soft-server sshd[11935]: Received disconnect from 10.0.2.2: 11: disconnected by user

Nov 28 21:40:16 soft-server sshd[11933]: pam_unix_session(sshd:session): session closed for user myusername

How can I suddenly use password to login? Is there any possibility that my own operation makes this behavior happens?

share|improve this question

migrated from stackoverflow.com Dec 18 '11 at 9:10

This question came from our site for professional and enthusiast programmers.

    
"myusername" is not my actual username, my username is not common. I just use "myusername" for replacement. – M. Tong Dec 18 '11 at 8:47

Well, that's a legit sftp-via-ssh connection from your IP address. Either you've been keylogged, or (more likely in my opinion) you forgot that you set up password-based sftp for some application like DreamWeaver which is automatically logging in to your virtual host to keep its file repository up to date.

share|improve this answer

This is a real login. And to answer your question "how you can suddenly use a password login", It is because you simply have not disabled password authentication.

If you do not require password authentication for any of your users, you should set the PasswordAuthentication flag in your sshd_config to no, as password can be keylogged or bruteforced.

I personally do this and if at some moment I do require password authentication, (like in emergencies when I do have a computer but no keys at my disposal), I simply login through my VPS control panel and enable password auth via SSLVNC.

If you DO have some users that need to be able to password authenticate, you can use Match User or Match Group like so:

PasswordAuthentication no
Match User passwordauthuser
    PasswordAuthentication yes

or

PasswordAuthentication no
Match Group passwordauth
    PasswordAuthentication yes

Another option you have if you REALLY need password authentication, is something I have done in the past, nl create a very long user name that is close to unguessable to reduce chance of someone guessing that user.

For example echo "mysupersecretuser" | sha256sum | sha256sum. This is still prone to keylogging or clipboard hijacking. But obviously reduces the chance for someone to guess your user to a nihillum.

Finally, If you're really paranoid, check all allowed SSH keys on your server, change ALL passwords and users for all your public services.

I do however believe in this case Jeff Albert is correct when stating this is probably an automated login from some service. If you do not know what service, you should disable the login anyways.

It's good practise to know what is connecting to your server in case of a breach of the application. (Memory can very easily be read out, and so can your stored passwords).

share|improve this answer

Looks like you've been hacked because you use a common username/password combination pair like myusername/mypassword.

You should

  1. ASAP change your password/username to a smth like mynEwp@$$_2011foobar
  2. check your root password too
  3. review shell history / system logs and inspect what commands was performed by hacked account
  4. rebind sshd to a non-default port, like 41022

the last action gives you some level of protection from automated 'worms' and 'bots'. They usually try to connect to default ports only.

PS: you can also try to entirely disable password-based authentication. Especially if it's not a problem for you to obtain a physical access to your server console.

share|improve this answer
2  
OMG you totally hackz0red his password! – Cody Gray Dec 18 '11 at 8:45
    
Thanks. But this is not my actual username, my username is not common. I just use "myusername" for replacement. – M. Tong Dec 18 '11 at 8:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.