Re: SSHD CPU spike

2015-07-09 Thread Mauro Souza
No, it would make it more secure. It's almost impossible to bruteforce a public key, and that is the only authentication method enabled. I would do it, but sometimes I have to ssh-in from other computers than my own, so public key authentication only would not be desired. I always have my phone,

Re: SSHD CPU spike

2015-07-09 Thread Jake Anderson
Hi Philippe Disabling the two features won't be a security vulnerability? Jake On Thursday 9 July 2015, Philipp Kern pk...@debian.org wrote: On Wed, Jul 08, 2015 at 03:45:01PM -0300, Mauro Souza wrote: I have a VPS that got a continuous stream of ssh login attempts, so I set up fail2ban

Re: SSHD CPU spike

2015-07-09 Thread Philipp Kern
On Wed, Jul 08, 2015 at 03:45:01PM -0300, Mauro Souza wrote: I have a VPS that got a continuous stream of ssh login attempts, so I set up fail2ban on it. After that, I changed SSH port from 22 to a random one. And installed portsentry. And configured PAM to use Google Authentication for SSH.

SSHD CPU spike

2015-07-08 Thread Jake Anderson
Hi Cross posted to omvs oe Hi I do have a sysview monitoring tool where I can see the PID,PPID value but the user shows as BPXOINIT. I am really struggling to find from where thus connections are made or the application responsible for the CPU spike. Is there a way to track the IP address

Re: SSHD CPU spike

2015-07-08 Thread Rick Troth
On 07/08/2015 02:20 PM, Jake Anderson wrote: Is there a way to track the IP address associated with a SSHD OTX task ? On all of my Linux systems (of any architecture), SSHD reports incoming connections in copious detail. Look where your SYSLOG traffic is recorded. Hopefully the OE SSHD logs

Re: SSHD CPU spike

2015-07-08 Thread Mauro Souza
I have a VPS that got a continuous stream of ssh login attempts, so I set up fail2ban on it. After that, I changed SSH port from 22 to a random one. And installed portsentry. And configured PAM to use Google Authentication for SSH. Doing this, the failed logins went to zero. No more bots crawling

Re: SSHD CPU spike

2015-07-08 Thread Scott Rohling
​A mother-in-law with Linux? Totally OT - but wow - you rock... Scott Rohling​ On Wed, Jul 8, 2015 at 11:50 AM, Mark Post mp...@suse.com wrote: On 7/8/2015 at 02:38 PM, Rick Troth r...@casita.net wrote: If the system in question is externally facing, it's likely that you're getting hit

Re: SSHD CPU spike

2015-07-08 Thread Mark Post
On 7/8/2015 at 02:38 PM, Rick Troth r...@casita.net wrote: If the system in question is externally facing, it's likely that you're getting hit by a brute force attack. It is common. (Picture vagrants walking down your street trying every door, with a ring of door keys, just for analogy.)