Ryan Flannery wrote:
On Fri, Aug 21, 2009 at 1:19 AM, Uwe Dippel<[email protected]> wrote:
Recently, I noticed an ssh user on one of my machines, who never logged on,
is not visible with 'last', seems to have no terminal active, and is back
immediately after a reboot.
Hmm.
root 13415 0.0 0.9 3280 2420 ?? Ss 12:04PM 0:00.08 sshd:
isuser
isuser 702 0.0 0.7 3280 1824 ?? S 12:04PM 0:00.00 sshd: isuser
Whatever I do with finger, w, last, no trace of any activity; not even a
login.
Just to be clear here, do you see anything in /var/log/authlog?
Yes. Like
Accepted password for isuser from XXX.XX.XX.XX port 61802 ssh2
To be clear, the user exists, and logged on the last time three days ago
as far as 'last' is concerned.
