login on ttyu0 at night time??

  • Jul 23 00:52:02 login login on ttyu0 as root
    Jul 22 00:38:19 login login on ttyu0 as root
    Jul 21 00:53:45 login login on ttyu0 as root
    Jul 20 00:52:32 login login on ttyu0 as root
    Jul 19 01:14:23 login login on ttyu0 as root

    this came from system logs, what this means?

    Someone has violated my firewall?
    Thanks, TB

  • Galactic Empire

    Jul 31 16:35:01 sshd 89811 Accepted keyboard-interactive/pam for admin from IP-ADDRESS port 60243 ssh2

    Do you see anything like the above in Status -> System Logs -> System -> General

    If so you'll see the IP its comming from, otherwise type in last from a ssh prompt.

  • Netgate Administrator

    login on ttyu0 implies directly on the local console.
    Are your system log times correct? The timezone may be off.
    Do you login at the local console ever?
    Does your firewall reboot at that time?


  • system is up from 1 month, the console cable is connected to another device that shutdown at the login hour.
    Is this the case?

    Time is correct:


    root       ttyu0                           Wed Aug  1 00:42   still logged in
    root       ttyu0                           Tue Jul 31 00:58 - 00:42  (23:44)
    root       ttyu0                           Mon Jul 30 00:51 - 00:58 (1+00:07)

  • Rebel Alliance Developer Netgate

    ttyu0 is the serial console.

    Do you have your serial console connected anywhere? Maybe if you are connected with a USB serial adapter, when you shutdown the desktop or other PC it's plugged into, it sends a serial break which may make the menu redisplay which would cause that message.

Log in to reply