0

Somebody accessing my computer with my password, i want to know who login my system via ssh [email protected], i want to know that ip how to trace it.

1

2 Answers 2

4

sshd logs all authorizations in /var/log/auth.log . You can check for logins by performing grep sshd /var/log/auth.log. The output will look something the following:

Jun  5 13:56:06 computer-name sshd[1582]: Accepted password for user from 10.0.2.2 port 41341 ssh2

However, if you are sure that your system is compromised, these logs cannot be trusted. You need to change your password immediately, backup all data and reinstall the system. If an attacker managed to get root access (either because your user has sudo rights or through an exploit) to the system neither the logs nor any executables (even system ones) can be trusted. The only thing left to do is to nuke it from orbit.

3
  • yes it is working but this command grep sshd /var/log/auth.d Jun 7, 2014 at 6:34
  • @SridharMass my apologies, I mistyped the file name it is /var/log/auth.log
    – crasic
    Jun 7, 2014 at 6:35
  • Nothing returned for me. Oct 30, 2017 at 13:32
1

If the IP of the attacker is 192.168.8.345 then he's on your local network.

  1. Change your router to WPA2 encryption and change your router login info
  2. Change the password on your computer to something a little more eloborate

You won't be able to find out who or where this person is logging in from since they're local.

Edit: Try this code.

sudo ufw enable
sudo ufw block proto tcp from 192.168.8.345
5
  • In my Organisation password changes is not allowed so i can't, is there any option to block to accessing a particular user or particular IP. Jun 7, 2014 at 6:13
  • There is but it would be pointless since DHCP assigns a random IP every time you connect meaning as soon as you blocked their IP they could just relog and get a new IP rendering your block useless. You could try blocking the port temporarily on your firewall if you don't need SSH for anything (Port 22) though I'd really just recommend talking to your security guys at your business. Jun 7, 2014 at 6:17
  • Here there is no random IP, IP is fixed so this option is suitable for me. Jun 7, 2014 at 6:19
  • Oh in that case just add a rule to your firewall blocking that IP. Jun 7, 2014 at 6:20
  • It is really useful, but i can't vote up your question my reputation is low. Jun 7, 2014 at 6:36

Not the answer you're looking for? Browse other questions tagged .