Trying to rule out unauthorized access to my OMV-server

siddharta · 17. März 2020

Hi

Beginning yesterday I wasn't able to login to the WebGUI with admin or my ordinary user. I don't get any error message that the login/password is wrong, just return to the login screen. When I tried to login via ssh as root I get a password error and the same with admin and ordinary user (I can login via SCP as root which I thought was strange and made a posting about yesterday - Root login works in scp but not ssh. Strange?). I have now gotten the logs through SCP.

In the auth.log I only find one authorized login. This is roughly at the time I think I made my last successful login (the reason I'm not 100% is that it's from 127.0.0.1 but as I'm behind reverse proxy and usually gets to OMV through a password protected app dashboard, I feel 99% it's me). There was alot of unsuccessful tries in auth.log though.

Is there any other log than auth.log I should trawl through to be sure that no unauthorized access was made?

I would be grateful for any ideas how to remedy my not-being-able-to-login-to-WebGUI-or-ssh-with-any-user-problem as described in my post from yesterday (see link above) (in short - have backup bu no physical access to server, have root access through SCP).

Thank you

crashtest · 20. März 2020

Hook up a monitor and keyboard. If your root password doesn't work with a console connection, you're rebuilding. (Or, at least, searching for root password recovery operations.)

If you can get in, with a console connection, run omv-firstaid . In the menu, you can reset the GUI password.
________________________________________________________________________

Whatever your outcome is:

Since you're using a reverse proxy and exposing your server to the Net, you might want to consider disabling root access VIA SSH. Use sudo or su - root if you need to do something as the root user on the command line.

Jetzt mitmachen!