4 ms·
From the logs it sounds like maybe the password was in some lookup file or something. i.e. somehow that password was leaked and added to some list somehow. May
by obituary_latte 8y ago
From the logs it sounds like maybe the password was in some lookup file or something. i.e. somehow that password was leaked and added to some list somehow.
Maybe you’re right though.
- mercer 8y agoit's maddening that I can't tell for sure, but I'll agree that I find it still somewhat hard to believe that a 20-character random root password was brute-forced. EDIT: to be clear, I am pretty sure was the only person who used the root password to log in, and the single other user used a similarly long and random password with a different username. if I'd been compromised my problems would be quite a bit bigger. All I know is that right before the 'fatal' root login, there are 40.000+ lines of login attempts from ip's that originated from shady places (at least based on entering them in various GeoIP sites).