This question already has an answer here:
- How do I deal with a compromised server? 13 answers
I recently noticed that I have entries from an unknown IP address in my SSH logs. I performed a
grep to extract all entires that didn't contain my own IP address. I was presented with this:
Jul 24 22:06:54 server1 sshd: Accepted publickey for root from xxx.xxx.xx.xxx port 39721 ssh2 Jul 25 04:06:50 server1 sshd: Accepted publickey for root from xxx.xxx.xx.xxx port 40800 ssh2 Jul 25 04:08:30 server1 sshd: Received disconnect from xxx.xxx.xx.xxx: 11: disconnected by user
I have a few questions:
- Are the first two lines successfull or attempted log ins?
- Is the third line a disconnect resulting from a successfull or attempted log in?
- Is the four digit number in square brackets after
I'm running CentOS 5 on a dedicated server. I am using OpenSSH.