Im seeing a few root login entries in the auth.log in one of our database servers but I dont know if these are applications logging in to our database, or ssh log ins.
FWIW We are rotating our database users to stop using root.
1
-
Wonder why the downvote... This is something I couldn't find in the documentationPurefan– Purefan2015-02-13 13:10:35 +00:00Commented Feb 13, 2015 at 13:10
Add a comment
|
1 Answer
No, mysql is having it's own logs for logging.
-
Thats what I thought... so if I see 3 logins at the exact same second I should be concerned... Thanks!Purefan– Purefan2015-02-13 13:10:14 +00:00Commented Feb 13, 2015 at 13:10
-
Well... obviously somebody is trying to login for root via e.g. ssh. I assume, you have logon for root turned off as well as added some things like fail2ban on your box.frlan– frlan2015-02-13 13:12:09 +00:00Commented Feb 13, 2015 at 13:12
-
Yeah but I still needed to make sure about this, I thought since one of the apps connecting to this box does it via certificates for remote management that it would use OpenSSH and that it would trigger the auth.log entriesPurefan– Purefan2015-02-13 13:14:59 +00:00Commented Feb 13, 2015 at 13:14