Explaination of ssh:notty, [email protected], or [email protected].
Question sent in by Charles F. from Virginia.
Q: I recently logged into one of my Linux machines as root and have seen the following message:
Last failed login: Fri Aug 20 04:13:45 EDT 2014 from *.*.*.* on ssh:notty
Have I been hacked? Was is notty?
A: Notty (or no tty) means that someone has logged in using SFTP or another process which does not require a terminal or tty (TeleTypeWriter).
When a user logs in via SSH typically you are logged in on pts (pseudo terminal slave), which looks like this in a process list:
savona 18848 0.0 0.0 80492 7168 pts/2 S+ 10:38 0:00 ssh <host>
If you are logged in at a console, you are logged in on a tty, which looks like this:
savona 4749 4679 1 Mar20 tty2 00:42:51 /usr/bin/gnome-shell
When you log in via SFTP, which does not require a terminal, you are logged in on “notty” or no tty, which looks like this in a process list:
savona 19037 0.0 0.0 131528 4140 ? S 10:40 0:00 sshd: [email protected]
I hope this puts you at ease, but there are a few considerations you should use when securing SSH connection.
If you see a lot of these failed attempts, it could be an indication that someone is trying to brute force attack your system. You should investigate if you see a high number of these in quick succession.
If you are seeing [email protected], this means root has logged in via a means that does not require a tty (terminal). For security reasons, it is best to deny SSH access to the root user, or any kind of remote access in general.
To configure SSH to deny root login attempts by editing the /etc/ssh/sshd_config and ensure the "PermitRootLogin" is set to no.
Protections should be taken to secure SSH. Here are a couple example, but not a definitive list.
Use iptables or firewalld to only allow remote connections from trusted IP addresses. This is especially important if your system is accessible from the internet.
Configure SSH to listen on a non-standard port. For example you can configure SSH to listen on port 2222.
Of course there is A LOT more to securing a server and that is beyond the scope of this post. For more information you can read our "Definitive Guide to Securing the SSH Daemon" which goes into much more detail.
Related SSH Articles:
This site uses Akismet to reduce spam. Learn how your comment data is processed.
This can be a solution: certificate only root authentication. An extra layer of security is to disallow the use of sudo and su for any user not in, respectively, wheel and sudo group.
I do that for all my machines and now don't care at all about any bruteforces on port 22.
Also consider not hosting your ssh service on port 22 and choose a random port to minimize automated attacks on your SSH service
This was very helpful, thank you for taking the time to write all this out for us.
Solid educational article! Very helpful
a big thank you for sharing this -- i thought we were hacked.
Very helpful information. Thanks
Thanks for the info.
Join Our Newsletter
- Bash Scripting (17)
- Basic Commands (50)
- Featured (7)
- Just for Fun (5)
- Linux Quick Tips (98)
- Linux Tutorials (60)
- Miscellaneous (15)
- Network Tools (6)
- Reviews (2)
- Security (32)
Leave a Reply