I have server at OVH that suddenly went offline around 12:10 PM.
According to my logs the hacker came in with the root-user. Which means that he probably had my password. I already changed this password but I'm still wondering how he came in.
In the sshd_config says PermitRootLogin no
so they normally couldn't get in via SSH. So the only way to get in as root directly is via KVM and I'm the only one who has access to that.
This is the log at the time he went down. I could resolve it by a simple restart. But as I see the logs before this someone went in several times a root. And I'm pretty sure it wasn't me. Also the same logs are saying it goes on that someone is going in as root.
Jun 11 12:10:01 vps115965 systemd: Starting Session c3450 of user root.
Jun 11 12:10:01 vps115965 systemd: Started Session c3450 of user root.
Jun 11 21:31:02 vps115965 xinetd[2703]: START: gopher pid=22775 from=::ffff:46.182.107.117
My question. How can I disable root-login completely. For this I mean only a physically login. cronjobs running as root and sudo (as well as sudo -i) should still work.
My sever is running CentOS 7 (updates installed via cronjobs)
Thanks in advace
Jeroen
EDIT:
I discovered that the root-login is every 10 minutes from which I thought it should be scheduled. So I looked into the crontab an it appear that spamassassin is doing this. Since I don't use this anymore (I use my Norton IS for spamfiltering) I decided to remove it.
Since I don't have any evidence that I'm hacked anymore I'm thinking about just bad luck (Kernel Panic, maybe).
However I still want to know my question on how to disable the physic rootlogin.