The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

SSH login into server - not mine

Discussion in 'Security' started by itmonitor, Sep 8, 2015.

  1. itmonitor

    itmonitor Active Member

    Joined:
    Apr 10, 2014
    Messages:
    25
    Likes Received:
    1
    Trophy Points:
    3
    cPanel Access Level:
    Root Administrator
    Hello,

    I have a LAMP KVM server, with WHM installed into it. I received an email alert about an SSH login, from another country far from where I am based. Below you have the email report text. Aside this login coming from another country (I blocked the IP at the firewall and at cphulk), I would like to understand:

    1. what does it mean "Method: keyboard-interactive/pam authentication".
    2. is there any way to force logout from all users logged in into WHM?

    Any advice is welcome! :)

    IM

    Code:
    From: <root@xxx.xxxx.com>
    Date: 2015-09-08 21:37 GMT+02:00
    Subject: lfd on xxxx.xxxx.com: SSH login alert for user root from 85.159.xxx.xxx (NL/Netherlands/tsn85-159-236-219.dyn.nltelcom.net)
    To: root@xxx.xxx.com
    
    
    Time:    Tue Sep  8 15:37:42 2015 -0400
    IP:      85.159.xxx.xxx (NL/Netherlands/tsn85-159-236-219.dyn.nltelcom.net)
    Account: root
    Method:  keyboard-interactive/pam authentication
    
    
     
    #1 itmonitor, Sep 8, 2015
    Last edited by a moderator: Sep 8, 2015
  2. Infopro

    Infopro cPanel Sr. Product Evangelist
    Staff Member

    Joined:
    May 20, 2003
    Messages:
    14,466
    Likes Received:
    196
    Trophy Points:
    63
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
  3. itmonitor

    itmonitor Active Member

    Joined:
    Apr 10, 2014
    Messages:
    25
    Likes Received:
    1
    Trophy Points:
    3
    cPanel Access Level:
    Root Administrator
    Hi Infopro,

    many thanks for pointing to me those articles.
     
    Infopro likes this.
Loading...

Share This Page