Suspicious root tty logins
-
Hello. First off apologies if I'm not posting this in the right location. I am noticing two suspicious logins in my system log:
Feb 3 16:02:21 login 80816 login on ttyv0 as root
Feb 3 16:02:21 login 81922 login on ttyu0 as rootThey are suspicious to me because I have never logged in to my pfsense box via tty (I only use the web interface), and there is serial cable connected to it. there is a wifi router connected to it, if that is any helpful context. Any insight would be much appreciated.
Thanks in advance.
-
@Limrick08 said in Suspicious root tty logins:
login on ttyv0 as root
https://docs.netgate.com/pfsense/en/latest/troubleshooting/logs-console-root-login.html
This is normal. It means that the console menu stopped and restarted
-
@johnpoz Thanks so much, and sorry for the stupid question.
-
@Limrick08 not stupid by any means.
Seeing root logins would peak my interest as well to understand what they are ;)