These forums are read-only!
Who's the root login in my auth.log?
  • mlilley
    I've noticed that soon after (re)building my Ubuntu slice, a root login via ssh from 81.129.1.112 occurs. This definitely isn't me, so I'm assuming it's done as a normal part of the slice building process.

    On the off-chance that it is not, can someone please confirm? The IP appears to correspond to the host "host81-129-1-112.range81-129.btcentralplus.com" (an ISP in London).

    Thanks.
  • Gadget
    Yeah, I've seen that before. It's British Telecom. I know one of the Slicehost fellows is based out of London, so chances are good he did the setup for the master OS image. It always appears on the initial build. It's ok, the fellow in question is not trying to sneak into your Slice.. Hey, PickledOnion... how's that British accent doing?

    8-D
  • mlilley
    Looking more closely I've noticed the date of the log entry is Nov 22 (not today's date).
    So looks like residue log entries from when slicehost's base ubuntu image was created.
    Crisis over.
  • Gadget
    Yup. It's all good. He's on our side ;-)

    PS: Maybe you could edit the thread title so it doesn't have the IP?

    8-)
  • PickledOnion
    Hi guys,

    Yes that was me when I built the original image.

    Nothing to worry about - something to always look at is the date and time of the entry (although this can be faked).

    However, there is absolutely nothing to be concerned about for that entry.

    I thought I had deleted all the log files from when I built the images but it looks like one snuck through.

    I will go through them and delete them.

    Cheers, PickledOnion
Add a Comment