On Fri, Aug 21, 2009 at 1:19 AM, Uwe Dippel<udip...@uniten.edu.my> wrote: > Recently, I noticed an ssh user on one of my machines, who never logged on, > is not visible with 'last', seems to have no terminal active, and is back > immediately after a reboot. > Hmm. > root 13415 0.0 0.9 3280 2420 ?? Ss 12:04PM 0:00.08 sshd: > isuser > isuser 702 0.0 0.7 3280 1824 ?? S 12:04PM 0:00.00 sshd: isuser > Whatever I do with finger, w, last, no trace of any activity; not even a > login.
Just to be clear here, do you see anything in /var/log/authlog?
