Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

SSH login into server - not mine

Discussion in 'Security' started by itmonitor, Sep 8, 2015.

  1. itmonitor

    itmonitor Well-Known Member

    Joined:
    Apr 10, 2014
    Messages:
    83
    Likes Received:
    15
    Trophy Points:
    83
    cPanel Access Level:
    Root Administrator
    Hello,

    I have a LAMP KVM server, with WHM installed into it. I received an email alert about an SSH login, from another country far from where I am based. Below you have the email report text. Aside this login coming from another country (I blocked the IP at the firewall and at cphulk), I would like to understand:

    1. what does it mean "Method: keyboard-interactive/pam authentication".
    2. is there any way to force logout from all users logged in into WHM?

    Any advice is welcome! :)

    IM

    Code:
    From: <root@xxx.xxxx.com>
    Date: 2015-09-08 21:37 GMT+02:00
    Subject: lfd on xxxx.xxxx.com: SSH login alert for user root from 85.159.xxx.xxx (NL/Netherlands/tsn85-159-236-219.dyn.nltelcom.net)
    To: root@xxx.xxx.com
    
    
    Time:    Tue Sep  8 15:37:42 2015 -0400
    IP:      85.159.xxx.xxx (NL/Netherlands/tsn85-159-236-219.dyn.nltelcom.net)
    Account: root
    Method:  keyboard-interactive/pam authentication
    
    
     
    #1 itmonitor, Sep 8, 2015
    Last edited by a moderator: Sep 8, 2015
  2. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    16,309
    Likes Received:
    393
    Trophy Points:
    583
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
  3. itmonitor

    itmonitor Well-Known Member

    Joined:
    Apr 10, 2014
    Messages:
    83
    Likes Received:
    15
    Trophy Points:
    83
    cPanel Access Level:
    Root Administrator
    Hi Infopro,

    many thanks for pointing to me those articles.
     
    Infopro likes this.
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice