I have faced a problem with my VPS. It seems that someone has added his public key to my authorized_keys file and logged in to my VPS.
Postponed publickey for xxx from 184.108.40.206 port 52240 ssh2 [preauth] debug1: userauth-request for user root service ssh-connection method publickey [preauth] debug1: attempt 2 failures 0 [preauth] debug1: temporarily_use_uid: 0/0 (e=0/0) debug1: trying public key file /xxx/.ssh/authorized_keys debug1: fd 4 clearing O_NONBLOCK debug1: read_keyfile_line: /xxx/.ssh/authorized_keys line 1 exceeds size limit debug1: matching key found: file /xxx/.ssh/authorized_keys, line 6 RSA 63:26:51:7d:bb:fb:a7:6b:7a:a8:93:a9:25:91:c4:06 debug1: restore_uid: 0/0 debug1: ssh_rsa_verify: signature correct debug1: do_pam_account: called Accepted publickey for xxx from 220.127.116.11 port 52240 ssh2: RSA 63:26:51:7d:bb:fb:a7:6b:7a:a8:93:a9:25:91:c4:06 debug1: monitor_child_preauth: xxx has been authenticated by privileged process debug1: monitor_read_log: child log fd closed debug1: PAM: establishing credentials
Further information - I am enabling ssh authentication using both keys and passwords.
Any idea why this kind of issue happened in my VPS?