Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Strane process running - high load and SSH login not possible

Discussion in 'General Discussion' started by jeroman8, Jan 30, 2006.

  1. jeroman8

    jeroman8 Well-Known Member

    Joined:
    Mar 14, 2003
    Messages:
    410
    Likes Received:
    0
    Trophy Points:
    166
    last root -n 10

    That what the process is and when it's running I can't login to SSH.
    I need to kill the process in WHM first and then I can get in.
    Also it uses around 25% of the cpu.

    I do not use this command.
    It started a week ago - maybe right after I installed rkhunter.
    But I don't run rkhunter in cron but still this command shows up daily.

    Anyone know what it can be ?

    Thanks!
     
  2. Tagor

    Tagor Well-Known Member

    Joined:
    Mar 6, 2004
    Messages:
    193
    Likes Received:
    0
    Trophy Points:
    166
    You first need shell access before you can do anything. 'last' just shows the last logins.
     
  3. xerophyte

    xerophyte Well-Known Member

    Joined:
    Mar 16, 2003
    Messages:
    216
    Likes Received:
    0
    Trophy Points:
    166
    Location:
    Canada
    man last :
    last, lastb - show listing of last logged in users
    -num This is a count telling last how many lines to show.


    Looks like you have some root login notification script install on the server which screwing stuff take look at your /root/ and see if there any root login notification script there. if so remove it or /etc/profile

    hope that helps
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. jeroman8

    jeroman8 Well-Known Member

    Joined:
    Mar 14, 2003
    Messages:
    410
    Likes Received:
    0
    Trophy Points:
    166
    Ye, right ...
     
  5. jeroman8

    jeroman8 Well-Known Member

    Joined:
    Mar 14, 2003
    Messages:
    410
    Likes Received:
    0
    Trophy Points:
    166
    I did install chkrootkit same day as well as rkhunter.
    I think it might be the lastlog function or something with chkrootkit.
    But I do not have any crontabs on it so the it shouldn't run at all...
    Maybe it's been working in silence mode, sniffing or something..

    Well I deleted a bunch of stuff now so hopefully it will not start again.

    Thanks!
     
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice