I figured out what went wrong. My port 22 for ssh was open and root login enabled via SSH
I checked /var/log/secure and found login by some IP addresses never used by me. IP Lookup showed those IP belonging to south america. I think my machine was hacked Formatted the machine and disabled root login via SSH also blocked port 22 on router (WAN) Thank you very much for the help. On Thu, Nov 10, 2011 at 11:54 PM, Howard, Chris <howa...@prpa.org> wrote: > Nov 10 23:23:03 sahyadri sshd[1756]: User root not allowed because > shell /bin/ksh does not exist**** > > ** ** > > ** ** > > ** ** > > /bin/ksh does not exist**** > > ** ** > > That would definitely not work then.**** > > I don’t have a SL6.1 system at hand at the moment. Do you know if you > have /bin/tcsh ?**** > > Or, check out the contents of the /etc/shells file, it should have a list > of available shell commands.**** > > ** ** > > ** ** > > ** ** > -- Best Regards, Abhijeet Nagawade. +91-9422919428 http://www.Shrigonda.in
