I have a linux server running under a windows virtualbox. I use ssh with publickey to login, and use lftp's sftp feature for file transfer, which also use publickey.

Today when I check the log file, there is something making me very confused:

Nov 28 21:39:06 soft-server sshd[11933]: Accepted publickey for myusername from port 50590 ssh2 Nov 28 21:39:06 soft-server sshd[11933]: pam_unix_session(sshd:session): session opened for user myusername by (uid=0)

Nov 28 21:39:25 soft-server sshd[11946]: Accepted password for myusername from port 13494 ssh2

Nov 28 21:39:25 soft-server sshd[11946]: pam_unix_session(sshd:session): session opened for user myusername by (uid=0)

Nov 28 21:39:25 soft-server sshd[11948]: subsystem request for sftp by user myusername

Nov 28 21:40:16 soft-server sshd[11935]: Received disconnect from 11: disconnected by user

Nov 28 21:40:16 soft-server sshd[11933]: pam_unix_session(sshd:session): session closed for user myusername

How can I suddenly use password to login? Is there any possibility that my own operation makes this behavior happens?

  • "myusername" is not my actual username, my username is not common. I just use "myusername" for replacement.
    – M. Tong
    Dec 18, 2011 at 8:47

3 Answers 3


Well, that's a legit sftp-via-ssh connection from your IP address. Either you've been keylogged, or (more likely in my opinion) you forgot that you set up password-based sftp for some application like DreamWeaver which is automatically logging in to your virtual host to keep its file repository up to date.


This is a real login. And to answer your question "how you can suddenly use a password login", It is because you simply have not disabled password authentication.

If you do not require password authentication for any of your users, you should set the PasswordAuthentication flag in your sshd_config to no, as password can be keylogged or bruteforced.

I personally do this and if at some moment I do require password authentication, (like in emergencies when I do have a computer but no keys at my disposal), I simply login through my VPS control panel and enable password auth via SSLVNC.

If you DO have some users that need to be able to password authenticate, you can use Match User or Match Group like so:

PasswordAuthentication no
Match User passwordauthuser
    PasswordAuthentication yes


PasswordAuthentication no
Match Group passwordauth
    PasswordAuthentication yes

Another option you have if you REALLY need password authentication, is something I have done in the past, nl create a very long user name that is close to unguessable to reduce chance of someone guessing that user.

For example echo "mysupersecretuser" | sha256sum | sha256sum. This is still prone to keylogging or clipboard hijacking. But obviously reduces the chance for someone to guess your user to a nihillum.

Finally, If you're really paranoid, check all allowed SSH keys on your server, change ALL passwords and users for all your public services.

I do however believe in this case Jeff Albert is correct when stating this is probably an automated login from some service. If you do not know what service, you should disable the login anyways.

It's good practise to know what is connecting to your server in case of a breach of the application. (Memory can very easily be read out, and so can your stored passwords).


Looks like you've been hacked because you use a common username/password combination pair like myusername/mypassword.

You should

  1. ASAP change your password/username to a smth like mynEwp@$$_2011foobar
  2. check your root password too
  3. review shell history / system logs and inspect what commands was performed by hacked account
  4. rebind sshd to a non-default port, like 41022

the last action gives you some level of protection from automated 'worms' and 'bots'. They usually try to connect to default ports only.

PS: you can also try to entirely disable password-based authentication. Especially if it's not a problem for you to obtain a physical access to your server console.

  • 2
    OMG you totally hackz0red his password!
    – Cody Gray
    Dec 18, 2011 at 8:45
  • Thanks. But this is not my actual username, my username is not common. I just use "myusername" for replacement.
    – M. Tong
    Dec 18, 2011 at 8:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy