Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 25

Thread: Who has logged in to my remote desktop? [ubuntu]

  1. #11
    Join Date
    Sep 2006
    Beans
    8,623
    Distro
    Ubuntu 14.04 Trusty Tahr

    Re: Who has logged in to my remote desktop? [ubuntu]

    Quote Originally Posted by sinnadyr View Post
    But how come this user suddenly logged in to my remote desktop? And I can't seem to find the log over remote desktop connections.
    You're fine. They're not logged in. The attempts are failing:

    Code:
    Jan 21 13:50:37 mediacenter sshd[32624]: Failed password for bin from 184.107.179.242 port 39850 ssh2
    Jan 21 13:50:44 mediacenter sshd[32638]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.107.179.242 user=bin
    They're trying to get in via SSH not the remote desktop.

  2. #12
    Join Date
    Jun 2011
    Location
    Atlanta Georgia
    Beans
    1,771
    Distro
    Ubuntu 10.04 Lucid Lynx

    Re: Who has logged in to my remote desktop? [ubuntu]

    Quote Originally Posted by Lars Noodén View Post
    You're fine. They're not logged in. The attempts are failing:

    Code:
    Jan 21 13:50:37 mediacenter sshd[32624]: Failed password for bin from 184.107.179.242 port 39850 ssh2
    Jan 21 13:50:44 mediacenter sshd[32638]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.107.179.242 user=bin
    They're trying to get in via SSH not the remote desktop.
    Well...We can't really confirm they're not doing both can we?

    Obviously the OP's SSH is being bruteforced as has been already addressed, however is VNC available to the internet or only locally?

  3. #13
    Join Date
    Sep 2006
    Beans
    8,623
    Distro
    Ubuntu 14.04 Trusty Tahr

    Re: Who has logged in to my remote desktop? [ubuntu]

    Good point, I hadn't expected anything other than a tunneled remote desktop.

    @sinnadyr what kind of remote desktop have you enabled and are you tunneling it over SSH?

  4. #14
    Join Date
    Oct 2009
    Beans
    Hidden!
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: Who has logged in to my remote desktop? [ubuntu]

    Quote Originally Posted by Lars Noodén View Post
    Good point, I hadn't expected anything other than a tunneled remote desktop.

    @sinnadyr what kind of remote desktop have you enabled and are you tunneling it over SSH?
    That was my first thought when I saw the log.

    I am hoping that VNC isn't being exposed to the internet as the default vino server does not keep any logs last time I checked.
    Come to #ubuntuforums! We have cookies! | Basic Ubuntu Security Guide

    Tomorrow's an illusion and yesterday's a dream, today is a solution...

  5. #15
    Join Date
    Dec 2008
    Location
    Trondheim, Norway
    Beans
    38
    Distro
    Ubuntu 9.04 Jaunty Jackalope

    Re: Who has logged in to my remote desktop? [ubuntu]

    I have activated the native remote desktop sollution in Ubuntu, nothing else, and it says it is not connectible from the internet, even though I am able to.

    Simple SSH server is set up, no tunneling to remote desktop.

    But seriously, the remote desktop was connected to from another, unknown computer, since I am watching my movies and suddenly "another user is controlling your computer" pops up and windows are changing, movie is stopped and appearently a lot of keys is sent to my computer.

    I don't have any specific firewall set up, only running standard DD-WRT on my router.

  6. #16
    Join Date
    Sep 2006
    Beans
    8,623
    Distro
    Ubuntu 14.04 Trusty Tahr

    Re: Who has logged in to my remote desktop? [ubuntu]

    Ok. The first thing is to disable and remove the remote desktop sharing.

  7. #17
    Join Date
    Oct 2009
    Beans
    Hidden!
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: Who has logged in to my remote desktop? [ubuntu]

    Quote Originally Posted by Lars Noodén View Post
    Ok. The first thing is to disable and remove the remote desktop sharing.
    +1. I would reinstall tbh, once a machine has been cracked there is little you can do to make sure you have cleaned it up completely.
    Come to #ubuntuforums! We have cookies! | Basic Ubuntu Security Guide

    Tomorrow's an illusion and yesterday's a dream, today is a solution...

  8. #18
    Join Date
    Dec 2008
    Location
    Trondheim, Norway
    Beans
    38
    Distro
    Ubuntu 9.04 Jaunty Jackalope

    Re: Who has logged in to my remote desktop? [ubuntu]

    Quote Originally Posted by Lars Noodén View Post
    Ok. The first thing is to disable and remove the remote desktop sharing.
    Of course, won't use it until the case is cleared, so to speak

  9. #19
    Join Date
    Dec 2008
    Location
    Trondheim, Norway
    Beans
    38
    Distro
    Ubuntu 9.04 Jaunty Jackalope

    Re: Who has logged in to my remote desktop? [ubuntu]

    Quote Originally Posted by CharlesA View Post
    +1. I would reinstall tbh, once a machine has been cracked there is little you can do to make sure you have cleaned it up completely.
    Thats true... Damn it

  10. #20
    Join Date
    Oct 2009
    Beans
    Hidden!
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: Who has logged in to my remote desktop? [ubuntu]

    Quote Originally Posted by sinnadyr View Post
    Thats true... Damn it
    Back everything up and reinstall. I would suggest installing either 10.04, or 12.04, even though 12.04 won't be released for another 3 months, it is quite stable from what I have heard.
    Come to #ubuntuforums! We have cookies! | Basic Ubuntu Security Guide

    Tomorrow's an illusion and yesterday's a dream, today is a solution...

Page 2 of 3 FirstFirst 123 LastLast

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •