SSH logins from 0.0.0.0?

I just set up a new vps, and the default settings seem to have it set to email me on every successful ssh login, which is fine. However, this is the email that is coming through: Successful Root Login. Service: sshd Remote IP Address: 0.0.0.0 Authentication Database: system Username: root This notice is the result of a request made by a computer with the IP address of "0.0.0.0" through the "sshd" service on the server. It's every time I ssh in, I don't get a separate one with my actual ip in it, and I can see using the last command that my real ip is showing there (as well as my real ip in the https and ftp logs). I tried searching but I could not find anyone else with the same symptoms. Does anyone know why it would be showing my ip address like that? It's a much less useful security feature without the correct one in there, although it is still helpful to know if someone else is ssh'ing in when I am not working on the server. Thanks. -Michael

cPanelMichael

March 16, 2015 15:47

Hello, Are you using "su" to access root? If so, it's likely related to the issue described in the following thread:

mvandemar

March 19, 2015 05:02

March 19, 2015 15:15

Does it happen when connecting from any ISP/device? Are you connecting from a remote server? Thank you.

March 19, 2015 16:03

Apparently not. I just ssh'd in from another server and it did send me the correct IP info. Also, now I am getting no notifications at all when I ssh in from my home network (my isp is Verizon FIOS). Where are those emails controlled? -Michael

March 19, 2015 16:25

Root login notifications are manged at: "WHM Home >> Server Contacts >> Contact Manager" The email address utilized for the root contact is configured at: "WHM Home >> Server Contacts >> Edit System Mail Preferences" Thank you.

SSH logins from 0.0.0.0?

Comments

Didn't find what you were looking for?