5

I've just setup my Raspberry Pi. Checking the Auth.log, I noticed some failed attempts from a foreign IP address. However, there was one (final) attempt that confused me.

This line (also note the time has gone backwards)

Feb 23 21:29:52 raspberrypi sshd[17102]: Connection from 210.107.198.201 port 43566 on 192.168.0.102 port 22
Feb 23 21:17:13 raspberrypi systemd-logind[341]: New seat seat0.

I'm no security expert, but I know systemd-logind is a daemon that manages logins, but does the New seat seat0` indicate something successful?

The docs didn't really clarify it for me. I think it's related to this

AttachDevice() may be used to assign a specific device to a specific seat. The device is identified by its /sys path, and must be eligible for seat assignments. Takes three arguments: the seat id, the sysfs path, and a boolean for controlling PolicyKit interactivity (see above). Device assignments are persistently stored to disk. To create a new seat, simply specify a previously unused seat id. For more information about the seat assignment logic see Multi-Seat for Linux.

Some more lines if relevant

Feb 23 21:29:50 raspberrypi sshd[17099]: Connection from 210.107.198.201 port 43394 on 192.168.0.102 port 22
Feb 23 21:29:51 raspberrypi sshd[17099]: Invalid user admin from 210.107.198.201
Feb 23 21:29:51 raspberrypi sshd[17099]: input_userauth_request: invalid user admin [preauth]
Feb 23 21:29:52 raspberrypi sshd[17099]: Connection closed by 210.107.198.201 [preauth]
Feb 23 21:29:52 raspberrypi sshd[17102]: Set /proc/self/oom_score_adj to 0
Feb 23 21:29:52 raspberrypi sshd[17102]: Connection from 210.107.198.201 port 43566 on 192.168.0.102 port 22
Feb 23 21:17:13 raspberrypi systemd-logind[341]: New seat seat0.
Feb 23 21:17:14 raspberrypi sshd[405]: Set /proc/self/oom_score_adj from 0 to -1000
Feb 23 21:17:14 raspberrypi sshd[405]: Server listening on 0.0.0.0 port 22.
Feb 23 21:17:14 raspberrypi sshd[405]: Server listening on :: port 22.

1 Answer 1

9

New seat seat0 indicates that the login manager started successfully.

seat0 is a default seat in systemd and is created on service start (see Multi-Seat on Linux).

There must have been a reboot (likely not clean, probably the system crashed) on 21:29:52 (according to the clock settings before reboot). The lower numbers in PIDs also indicate that system was recently restarted.

Given the information in the question, not much else can be told. However, if you have not changed the default password for pi nor disabled the password authentication, then you can assume the system is not yours anymore.

1
  • 1
    Thanks. I changed the password upon first login. I don't think I've disabled password authentication, as I don't know where that setting is :P However I did change the setting to boot up without requiring login. I'm still required to enter a password to connect with ssh though. Since it looks like I haven't been hacked, I'll try and setup key-based login.
    – user126440
    Feb 24, 2017 at 11:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .