Got SSH Access ?
I checked lastlog and found one of my client (good one) loged into my server through SSH.
# lastlog|grep pts
<username> pts/0 <clientip> Tue Feb 17 02:28:56 +0000 2004
I checked
# cat /var/log/secure|grep <clientip>
Feb 17 02:28:55 server2 sshd[19180]: Accepted password for <username> from <clientip> port 61854 ssh2
The one accessed the server is my client only as i know his IP.
What is this SSH2 ?
I only use the SSH to connect to the server. Also
# cat /etc/passwd|grep <username>
<username>:x:568:569::/home/<username>:/usr/local/cpanel/bin/noshell
He is a reseller with WHM. I don't allow create package with SSH Access. Anyidea how he get in ?
Regards,
Yujin
