top - ssh sessions/processes

[Harold Hallikainen]

>
> Customer just called about a Fedora 6 box with
> an active hard disk. Ran top, and found 10 - 15 ssh tasks running.
>
> This is NOT normal for the specific machine.
>
> So, in /etc/ssh/sshd_config
>
>
> I changed the listento port to 5675 and set
>
> PermitRootLogin No
> Protocol 2
> ListenAddress   xx.xx.xx.xx  (to an internal ip address )
>
>
> Any ideas. Hackers...Yum update
>
> Which log can I look at to see WATZ-UP?
>
> Bret Stern
> Machine Management

On my FC4 machine, ssh logins are in /var/log/secure . Also, I get a daily
log summary emailed to me that shows the ssh logins. Finally, I also run a
script (sshblack) that blocks IP addresses that have failed ssh logins.

Harold


-- 
FCC Rules Updated Daily at http://www.hallikainen.com - Advertising
opportunities available!