Board logo

主題: [問題]關於一登入ssh就會自動寄信 [打印本頁]

發表人: kone    時間: 2009-12-5 12:09 PM     主題: [問題]關於一登入ssh就會自動寄信

最近發伺服器發現~~只要透過ssh登入,root就會發一封信內容為主機ip跟帳戶名稱及密碼給一位badbou@gmail.com的信箱,應該是是被入侵,但透過本端登入是不會發信 ,但透過ssh就會,想請教各位前輩~有沒有在那個設定裡面有關於一登入ssh就會自動執行什麼動作的設定,因為查了排程、跟at好像都無可疑的script…,我還有那些方便可以查呢…如果可以,請各位前輩,給小弟我些意件吧…感恩不盡
發表人: azactam    時間: 2009-12-5 01:54 PM

When a user successfully logs in, sshd does the following:

           1.   If the login is on a tty, and no command has been specified,
                prints last login time and /etc/motd (unless prevented in the
                configuration file or by ~/.hushlogin; see the FILES section).

           2.   If the login is on a tty, records login time.

           3.   Checks /etc/nologin; if it exists, prints contents and quits
                (unless root).

           4.   Changes to run with normal user privileges.

           5.   Sets up basic environment.

           6.   Reads the file ~/.ssh/environment, if it exists, and users are
                allowed to change their environment.  See the
                PermitUserEnvironment option in sshd_config(5).

           7.   Changes to user's home directory.

           8.   If ~/.ssh/rc exists, runs it; else if /etc/ssh/sshrc exists,
                runs it; otherwise runs xauth.  The ``rc'' files are given the
                X11 authentication protocol and cookie in standard input.  See
                SSHRC, below.

           9.   Runs user's shell or command.

[azactam 在  2009-12-5 01:55 PM 作了最後編輯]




歡迎光臨 TWed2k (http://twed2k.org/) Powered by Discuz! 4.1.0