Re: How could this account have been cracked?

Nathanael Hoyle wrote:
So the account's existence was probably not revealed by the login (if
there were already a keylogger on the system, you were flat screwed from
the start).

Yes, and this may be the case.

So, although that logically, there's no real true defense, I've done a
few things (added deny all sshd, removed software I'm not using...) and
hopefully the system will hold for a week or two until I have the money
and time to rebuild the server.

.

Relevant Pages

  • Re: How could this account have been cracked?
    ... (if there were already a keylogger on the system, you were flat ... I have the money and time to rebuild the server. ...
    (comp.os.linux.security)
  • Re: Server Activity
    ... doing while they are logged into our server. ... administrative rights that logs into our server and helps us when we ... something like a keylogger would not work. ... Seriously, if you have reason to distrust this user, take away the admin ...
    (microsoft.public.windows.server.general)