All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
sshd high CPU usage
I noticed on one of my servers that I'd see a spike in CPU usage to 20% for a few hours and then it'd drop. I set my alert threshold to be much lower so I could see what was going on when this happened. It would appear that sshd is occasionally consuming 15 - 20% CPU for a prolonged period of time in very short bursts. I realized fail2ban wasn't installed on this server, so I installed that and checked the sshd auth logs. Nothing abnormal in the auth logs, just a few random attempts every minute. This didn't seem to help. I'm not really sure what could be causing this, so I thought I'd see if anyone has any ideas? I will be dropping all traffic to port 22 to see if this helps over the next few days just to see if that helps. Overall resource usage is low, this is a database server that is not really being utilized. I'm more concerned with the potentially abnormal behavior than resource usage.
Monitoring - https://imgur.com/a/3r8z9Sf
sshd in top - https://imgur.com/a/nEgHpBU
Comments
Move ssh port away from 22
Hi,
in general you could start the ssd with debug flags. That will spam your log but at least you would get a better insight of what sshd is doing.
Before that, just like you already suggested, move sshd away to some other port or, if possible, maybe even bind it to 127.0.0.1 to make sure that no external event can be the cause.
If you cant find anything, boot your system into the system rescue iso and check if the behavior is there. If its not, then you have a hint that your system might be hacked already. If its still there, then, well, things would become super ugly, maybe asking for some voodoo doctor to support you to get the bad ghost out of your server
None of the auth attempts were to port 22, so I'm not confident this would solve the issue
I'll try that tomorrow if it happens again. It was happening overnight while I was sleeping, so I was glad to just be able to observe for a bit. My fear is it's malicious but...
https://imgur.com/a/dtM7JAf You can see where I installed fail2ban and then you can see where I blocked port 22, so maybe that really was the issue... I'm definitely open to calling a voodoo priest if it doesn't work out
Hi,
if it was just a short time event, then you will actually not catch that now easily.
So for now, simply observe. Good luck!