3

Just a moment ago I ran the who command on my router and I noticed myself logged in on vty 1 but another user root was on vty 0. The Location under that user is some location I do not know (someone from klayer.com). But the strange thing is that I do not see any root user in the running-config. If I run show running-config | i username then I only get the two names that have been configured, me and another guy who has access (this is not him logged in as root) but no user named root. How can this be?

I am afraid that I have been hacked and if that is the case then I need to know how to disable this account, and if I can't see it in the running-config then I guess it is not possible to disable it or change the password on it by normal means.

Is this perhaps some dummy account?

EDIT:

after running who a few times I get this:

ROUTER#show users
    Line       User       Host(s)              Idle       Location
 132 vty 0     dummy      idle                 00:00:02
                                             104.143.47.64.static.klayer.com
*133 vty 1     xxx        idle                 00:00:00 mydomain

  Interface    User               Mode         Idle     Peer Address

ROUTER#show users
    Line       User       Host(s)              Idle       Location
 132 vty 0     ebooks     idle                 00:00:03
                                             104.143.47.64.static.klayer.com
*133 vty 1     xxx        idle                 00:00:00 mydomain

  Interface    User               Mode         Idle     Peer Address

ROUTER#show users
    Line       User       Host(s)              Idle       Location
 132 vty 0     ec2        idle                 00:00:02
                                             104.143.47.64.static.klayer.com
*133 vty 1     xxx        idle                 00:00:00 mydomain

  Interface    User               Mode         Idle     Peer Address

ROUTER#show users
    Line       User       Host(s)              Idle       Location
 132 vty 0                idle                 00:00:01
                                             104.143.47.64.static.klayer.com
*133 vty 1     xxx        idle                 00:00:00 mydomain

Is this just tries to get into my router? I can see the user name changing from dummy to ebooks to ec2 to nothing, just like he is trying to log in. Does the show users/who commands show unsuccessfull tries as vty lines?

1
  • You're just witnessing a brute-force attack on your router. You might want to restrict access to only the internal network. Oct 28, 2015 at 23:11

0

You must log in to answer this question.

Browse other questions tagged .