quietFinn

Well-Known Member
Feb 4, 2006
1,222
87
178
Finland
cPanel Access Level
Root Administrator
Hi had a notification for SSH login alert for a user, but when i check the shell access disabled on there account and cant see how they have managed to login via ssh.
They can login using SFTP and you will get that SSH login alert.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,913
2,201
363
Hello :)

Note that if you want to see if the server was accessed via SFTP during the same time frame, simply check /var/log/secure for an entry such as:

Code:
subsystem request for sftp
Thank you.