[net] user connction to sshd

Sean Kirkby skirkby at concentrico.net
Sat Jul 9 22:53:21 MDT 2005

We noticed yesterday that there were a number of connections to the SSH
daemon running on a test box we had running outside our firewall
(running RH 8.0!).  The connections were from someplace in Florida, and
someplace in Germany (we think).
The user name for the connections were "[net]" (sans quotes)... none
such exists in the shadow file.
Any ideas what this "[net]" user means?  As best we could tell, the
connections were benign (but unsettling)... we've since shut SSHD down
on that box, but I am still curious to know what that user ID is or
Any idears would be appreciated...
Sean Kirkby
Concentrico, Inc.
P: (801) 221-7606 x204
W: www.Concentrico.net 
GroupWise and Linux
     to the Nth Power
- Formativ Solutions
- World-Class Service

More information about the PLUG mailing list