it's maddening that I can't tell for sure, but I'll agree that I find it still somewhat hard to believe that a 20-character random root password was brute-force

it's maddening that I can't tell for sure, but I'll agree that I find it still somewhat hard to believe that a 20-character random root password was brute-forced. EDIT: to be clear, I am pretty sure was the only person who used the root password to log in, and the single other user used a similarly long and random password with a different username. if I'd been compromised my problems would be quite a bit bigger. All I know is that right before the 'fatal' root login, there are 40.000+ lines of login attempts from ip's that originated from shady places (at least based on entering them in various GeoIP sites).