It's a blog.
In: Uncategorized
14 Feb 2010I assume most people know this, but for the benefit of those who get paged at 4am and are maybe not at their mental prime, here it goes:
If you see “sshd: root@notty” in your process list and find yourself wondering what box “notty” is and assuming you’ve been hacked and it’s some malicious connection to some mysterious box named “notty”… Relax. “notty” isn’t a mysterious hostname. In keeping with all the other “sshd: root@pts/1″ sort of entries you might see, it’s the TTY the connection is on, not the hostname. Or, in this case, it’s no TTY, because it’s something like scp, not an interactive session.
Related posts:
17 Responses to FYI: root@notty
Jesper
September 1st, 2010 at 8:14 am
Ok, can’t even use the 4am as an excuse, since its only 2pm… Sure is glad I googled mr ‘notty’ however, before I started to cry wolf – you just spared me for an embarrasing moment there ;)
JT
September 20th, 2010 at 3:05 am
Um me too… 12 am. THANK YOU!
RB
October 10th, 2010 at 6:55 am
Me 3…
But I went through killing all the procceses and changing all the passwords, only to see it pop back up then I googled it…
Matt Stevens
October 20th, 2010 at 6:49 am
lol, thank you for this! I was just running through snort and the rest of my log files to see who was on my box!
Matt.
Alex
January 14th, 2011 at 7:21 pm
Wow .. praise google. .. I was checking a server for some strange things going on, looked at the task list .. and almost thought the bad guys were in … :-|
(btw ‘just’ 1:20 AM)
David
January 19th, 2011 at 11:49 am
Thank you for that one:) Saved me a lot of time.
Luke
January 26th, 2011 at 6:29 pm
Thanks pal, my heart sunk when I saw that in my ps aux output and now I know what it is haha. Cheers.
aktiwers
March 13th, 2011 at 10:48 pm
12AM
Shane
April 7th, 2011 at 11:01 am
Only 12PM here…
Thanks ;)
Ahmad
June 7th, 2011 at 10:54 pm
11:54pm here..
What’s a mental prime?
michael
December 20th, 2011 at 5:37 am
fine to see that i’m not the only one who didn’t know mr. notty …
Oleg
January 8th, 2012 at 2:50 pm
I was quite confused when saw this @notty in my process list. notty=no tty, so simple :)
mot
January 22nd, 2012 at 2:39 pm
haha – thats all i could say… thanks
matt
February 10th, 2012 at 11:17 pm
ummmmm 11:18 pm mr notty doing ok lol
PS Thanks!
:P
Daniel
May 25th, 2012 at 2:23 am
7.30am here, coffee hasn’t kicked in yet
no need to kill off Mr @notty it seems, thanks a lot :)
david
July 12th, 2012 at 12:01 am
had a similar question&problem and found out that i had my WINSCP configured to connect with ssh, so this produced that process and i thought it’s someone else since i used a different ssh software simultaneously ;)
daniel
February 17th, 2013 at 12:06 pm
lmao! 1am here xD