I've set up a public-facing Debian server on a well-known web hosting provider and am trying to determine if hackers are breaking in. I know very little about securing web servers but I am trying to learn. I've configured my server to disallow root logins over SSH and I've also disabled password logins via SSH. All users must use SSH key authentication. I've also installed Fail2ban. I have an account but there aren't any other users so no one else should be logging in but me.
When I run the command "sudo last -f /var/log/btmp" to view bad login attempts I see entries like the following:
ubnt ssh:notty <ipaddress1> <date1> 16:55 - 17:22 (00:27) admin ssh:notty <ipaddress2> <date2> 11:56 - 16:55 (04:58) user ssh:notty <ipaddress3> <date3> 07:47 - 08:24 (00:36) pi ssh:nottyp <ipaddress4> <date4> 10:46 - 11:11 (00:24)
Do these entries really indicate that hackers have been able to log in despite my precautions?
What I also don't understand is that if I run the command "sudo lastb -f /var/log/btmp", I'll see the same entries as above except that the "time in" and "time out" entries are all the same. In other words, instead of this:
# sudo last -f btmp ubnt ssh:notty <ipaddress1> <date1> 16:55 - 17:22 (00:27)
I see this:
# sudo lastb -f btmp ubnt ssh:notty <ipaddress1> <date1> 16:55 - 16:55 (00:00)
After reading the man page for last, lastb, the problem may be that I shouldn't be running last against btmp but that I should be running lastb against it instead. Perhaps just because you can specify a "-f " parameter for each command, that doesn't mean the commands are interchangable.
I should also add that there aren't any accounts in my /etc/passwd file with the usernames shown above. If people are still logging in without my knowledge, what other things can I do to prevent this?