Christian Zimmermann writes
adnetec@citec.repec.org
Looks like that JMBC added a key on 10 December adnetec@iripa:~$ ls -l .ssh/authorized_keys -rw-r--r-- 1 adnetec adnetec 9689 dic 20 13:15 .ssh/authorized_keys adnetec@iripa:~$ diff .ssh/authorized_keys .ssh/authorized_keys~ 31,32d30 < #### JMB putty at home < ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAhI08EygnSUi6kbS0s2Q8FqQqH7D597zTRV63wvxJgc+P5mHSorsfiFpwKtb1ER2awP89ZV419jkPTGorbB5AZC9WsdETqwW7kz0pqQbvlzFP5uT81pWi6Sw5EtvJ2uWp1Z2yjOazgxHss+63gR6iYEyKzfvDEquxkXzkuBY+5b74yeh4mJG+UB/9MiI/3T/FMx2naSuxiyCrkMNWeDzbi98OvXVWk9VPAImWVnHsckOKFo8/Ft5dzlRbjrltNYo1nUFVruaebmhrApr0b0MnGH3AREOqRQV7kljd4QLNiW24RPO07PikLkKyFEdiDIiWWuUZvqvszuZZyRWCPYZCYw== But that should not have stopped you. root@iripa /var/log # grep adnetec auth.log.1 | grep -v 'session closed' | grep -v 'session opened' | tail -50 Dec 22 05:44:02 iripa systemd-logind[831]: New session 1751 of user adnetec. Dec 22 06:31:00 iripa sshd[24652]: Disconnected from user adnetec 83.143.64.71 port 50854 Dec 22 07:26:46 iripa sshd[31401]: Failed password for adnetec from 34.193.214.223 port 40525 ssh2 Dec 22 07:26:47 iripa sshd[31402]: Failed password for adnetec from 34.193.214.223 port 40524 ssh2 Dec 22 07:26:47 iripa sshd[31401]: Failed password for adnetec from 34.193.214.223 port 40525 ssh2 Dec 22 07:26:47 iripa sshd[31402]: Failed password for adnetec from 34.193.214.223 port 40524 ssh2 Dec 22 07:26:47 iripa sshd[31401]: Connection closed by authenticating user adnetec 34.193.214.223 port 40525 [preauth] Dec 22 07:26:47 iripa sshd[31402]: Connection closed by authenticating user adnetec 34.193.214.223 port 40524 [preauth] Dec 22 14:50:34 iripa sshd[30050]: Accepted publickey for adnetec from 83.143.64.71 port 33588 ssh2: RSA SHA256:3SY1ZUOHMcFoH/7fiw98FuOmP4o/U32mR3Z5ZUZxtuk Dec 22 14:50:35 iripa systemd-logind[831]: New session 1811 of user adnetec. Dec 22 15:40:01 iripa sshd[30057]: Disconnected from user adnetec 83.143.64.71 port 33588 Dec 23 04:59:45 iripa sshd[25895]: Accepted publickey for adnetec from 34.193.214.223 port 42238 ssh2: RSA SHA256:CIKQ/ZHK9xFnUANaZgeT/kZ7vixCpzWxNp3DByQXj/M Dec 23 04:59:45 iripa systemd-logind[831]: New session 1907 of user adnetec. Dec 23 05:01:46 iripa sshd[25906]: Disconnected from user adnetec 34.193.214.223 port 42238 Dec 23 05:08:45 iripa sshd[28048]: Accepted publickey for adnetec from 34.193.214.223 port 42322 ssh2: RSA SHA256:CIKQ/ZHK9xFnUANaZgeT/kZ7vixCpzWxNp3DByQXj/M Dec 23 05:08:45 iripa systemd-logind[831]: New session 1909 of user adnetec. Dec 23 05:08:47 iripa sshd[28059]: Disconnected from user adnetec 34.193.214.223 port 42322 Dec 23 05:44:02 iripa sshd[1694]: Accepted publickey for adnetec from 83.143.64.71 port 47722 ssh2: RSA SHA256:3SY1ZUOHMcFoH/7fiw98FuOmP4o/U32mR3Z5ZUZxtuk Dec 23 05:44:02 iripa systemd-logind[831]: New session 1915 of user adnetec. Dec 23 06:17:14 iripa sshd[1700]: Disconnected from user adnetec 83.143.64.71 port 47722 Dec 23 07:26:45 iripa sshd[8146]: Failed password for adnetec from 34.193.214.223 port 44418 ssh2 Dec 23 07:26:45 iripa sshd[8147]: Failed password for adnetec from 34.193.214.223 port 44419 ssh2 Dec 23 07:26:45 iripa sshd[8146]: Failed password for adnetec from 34.193.214.223 port 44418 ssh2 Dec 23 07:26:45 iripa sshd[8147]: Failed password for adnetec from 34.193.214.223 port 44419 ssh2 Dec 23 07:26:45 iripa sshd[8146]: Connection closed by authenticating user adnetec 34.193.214.223 port 44418 [preauth] Dec 23 07:26:45 iripa sshd[8147]: Connection closed by authenticating user adnetec 34.193.214.223 port 44419 [preauth] Dec 23 10:54:53 iripa sshd[17571]: Accepted publickey for adnetec from 83.143.64.71 port 60544 ssh2: RSA SHA256:3SY1ZUOHMcFoH/7fiw98FuOmP4o/U32mR3Z5ZUZxtuk Dec 23 10:54:53 iripa systemd-logind[831]: New session 1952 of user adnetec. Dec 23 11:14:37 iripa sshd[17578]: Disconnected from user adnetec 83.143.64.71 port 60544 Dec 24 04:59:43 iripa sshd[20915]: Accepted publickey for adnetec from 34.193.214.223 port 42330 ssh2: RSA SHA256:CIKQ/ZHK9xFnUANaZgeT/kZ7vixCpzWxNp3DByQXj/M Dec 24 04:59:43 iripa systemd-logind[831]: New session 2075 of user adnetec. Dec 24 05:01:34 iripa sshd[20922]: Disconnected from user adnetec 34.193.214.223 port 42330 Dec 24 05:08:43 iripa sshd[21316]: Accepted publickey for adnetec from 34.193.214.223 port 42436 ssh2: RSA SHA256:CIKQ/ZHK9xFnUANaZgeT/kZ7vixCpzWxNp3DByQXj/M Dec 24 05:08:43 iripa systemd-logind[831]: New session 2077 of user adnetec. Dec 24 05:08:45 iripa sshd[21322]: Disconnected from user adnetec 34.193.214.223 port 42436 Dec 24 05:44:02 iripa sshd[23000]: Accepted publickey for adnetec from 83.143.64.71 port 42000 ssh2: RSA SHA256:3SY1ZUOHMcFoH/7fiw98FuOmP4o/U32mR3Z5ZUZxtuk Dec 24 05:44:02 iripa systemd-logind[831]: New session 2083 of user adnetec. Dec 24 06:03:26 iripa sshd[23006]: Disconnected from user adnetec 83.143.64.71 port 42000 Dec 24 07:26:44 iripa sshd[27257]: Failed password for adnetec from 34.193.214.223 port 44828 ssh2 Dec 24 07:26:44 iripa sshd[27258]: Failed password for adnetec from 34.193.214.223 port 44826 ssh2 Dec 24 07:26:44 iripa sshd[27257]: Failed password for adnetec from 34.193.214.223 port 44828 ssh2 Dec 24 07:26:44 iripa sshd[27258]: Failed password for adnetec from 34.193.214.223 port 44826 ssh2 Dec 24 07:26:44 iripa sshd[27257]: Connection closed by authenticating user adnetec 34.193.214.223 port 44828 [preauth] Dec 24 07:26:44 iripa sshd[27258]: Connection closed by authenticating user adnetec 34.193.214.223 port 44826 [preauth] Dec 24 13:30:28 iripa sshd[11985]: Accepted publickey for adnetec from 83.143.64.71 port 34882 ssh2: RSA SHA256:3SY1ZUOHMcFoH/7fiw98FuOmP4o/U32mR3Z5ZUZxtuk Dec 24 13:30:28 iripa systemd-logind[831]: New session 2135 of user adnetec. Dec 24 13:51:57 iripa sshd[11992]: Disconnected from user adnetec 83.143.64.71 port 34882 Dec 24 20:36:05 iripa sshd[24906]: Accepted publickey for adnetec from 67.245.36.20 port 55108 ssh2: RSA SHA256:0HHxMT42qYXSwsYJwxesasbIjq5Wqn4oeSVdQU5H+Og Dec 24 20:36:05 iripa systemd-logind[831]: New session 2181 of user adnetec. Dec 24 20:36:06 iripa sshd[24913]: Disconnected from user adnetec 67.245.36.20 port 55108 Is your box among them? -- Cheers, Thomas Krichel http://openlib.org/home/krichel skype:thomaskrichel