I have a server running Debian 6.0 with logcheck installed. Yesterday ago, I received this message:
Jan 19 19:15:10 hostname sshd: Authentication tried for root with correct key but not from a permitted host (host=4.red-2-140-77.dynamicip.rima-tde.net, ip=18.104.22.168).
I don't know who this is and I doubt he was there by accident.
Now, what should I do?
First thing I did was to disable ssh password authentication and switched to public/private key. I also check the authorized_keys file and saw only my public key
How can I know what the other guy did on my machine?