how to find which software is doing ssh connection?Ubuntu SSH issueHow do I clear out the ssh-agent entries (on Mac OS X )?Potential SSH security problem?weird SSH connection timed outHow to use ssh-copy-id on a non-standard portSFTP Connection to Windows 2008 Server Running RemotelyAnywhereCannot access srx220 router from browserPasswordless ssh2 not working, to many authentication failuresfail2ban has maxretry of 3 but I see authentication failures repeated 5 timesPermission denied, please try again - when trying to ssh to a machine
I just entered the USA without passport control at Atlanta airport
Why was New Asgard established at this place?
How to recover a single blank shot from a film camera
How to ask if I can mow my neighbor's lawn
Basic power tool set for Home repair and simple projects
Should I email my professor to clear up a (possibly very irrelevant) awkward misunderstanding?
Is there a risk to write an invitation letter for a stranger to obtain a Czech (Schengen) visa?
What is this plant I saw for sale at a Romanian farmer's market?
Why do you need to heat the pan before heating the olive oil?
First occurrence in the Sixers sequence
Why we can't jump without bending our knees?
A medieval book with a redhead girl as a main character who allies with vampires and werewolves against scientific opposition
Are there any individual aliens that have gained superpowers in the Marvel universe?
How can the US president give an order to a civilian?
How did the European Union reach the figure of 3% as a maximum allowed deficit?
My student in one course asks for paid tutoring in another course. Appropriate?
How is linear momentum conserved in circular motion?
Is it a bad idea to have a pen name with only an initial for a surname?
How to make a villain when your PCs are villains?
Having some issue with notation in a Hilbert space
Time at 1G acceleration to travel 100 000 light years
How would Japanese people react to someone refusing to say “itadakimasu” for religious reasons?
Checking if argument is a floating point without breaking on control sequences in argument
How can I ping multiple IP addresses at the same time?
how to find which software is doing ssh connection?
Ubuntu SSH issueHow do I clear out the ssh-agent entries (on Mac OS X )?Potential SSH security problem?weird SSH connection timed outHow to use ssh-copy-id on a non-standard portSFTP Connection to Windows 2008 Server Running RemotelyAnywhereCannot access srx220 router from browserPasswordless ssh2 not working, to many authentication failuresfail2ban has maxretry of 3 but I see authentication failures repeated 5 timesPermission denied, please try again - when trying to ssh to a machine
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I use key (not password) to do the ssh.
But my ip frequently banned by server.
After look into the server auth.log.
I found someone(software) is doing the ssh with wrong password every 10-20 minutes.
Jun 15 21:23:26 www sshd[31046]: Failed password for git from 218.81.128.80 port 37012 ssh2
Jun 15 21:23:26 www sshd[31046]: error: maximum authentication attempts exceeded for git from 218.81.128.80 port 37012 ssh2 [preauth]
Jun 15 21:23:26 www sshd[31046]: Disconnecting authenticating user git 218.81.128.80 port 37012: Too many authentication failures [preauth]
Jun 15 21:33:26 www sshd[31931]: Failed password for git from 218.81.128.80 port 37146 ssh2
Jun 15 21:33:26 www sshd[31931]: Failed password for git from 218.81.128.80 port 37146 ssh2
Jun 15 21:33:26 www sshd[31931]: error: maximum authentication attempts exceeded for git from 218.81.128.80 port 37146 ssh2 [preauth]
Jun 15 21:33:26 www sshd[31931]: Disconnecting authenticating user git 218.81.128.80 port 37146: Too many authentication failures [preauth]
Jun 15 21:53:26 www sshd[870]: Failed password for git from 101.81.237.208 port 37384 ssh2
Jun 15 21:53:26 www sshd[870]: Failed password for git from 101.81.237.208 port 37384 ssh2
Jun 15 21:53:26 www sshd[870]: error: maximum authentication attempts exceeded for git from 101.81.237.208 port 37384 ssh2 [preauth]
Jun 15 21:53:26 www sshd[870]: Disconnecting authenticating user git 101.81.237.208 port 37384: Too many authentication failures [preauth]
i'm using pycharm/phpstorm etc and set a git server on my server.
i've checked the settings of this 2 software and have no idea what is happening. I even changed my computer but made no difference.
ssh
asked 11 hours ago
Charles BaoCharles Bao
1213
New contributor
Charles Bao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
I use key (not password) to do the ssh.
But my ip frequently banned by server.
After look into the server auth.log.
I found someone(software) is doing the ssh with wrong password every 10-20 minutes.
Jun 15 21:23:26 www sshd[31046]: Failed password for git from 218.81.128.80 port 37012 ssh2
Jun 15 21:23:26 www sshd[31046]: error: maximum authentication attempts exceeded for git from 218.81.128.80 port 37012 ssh2 [preauth]
Jun 15 21:23:26 www sshd[31046]: Disconnecting authenticating user git 218.81.128.80 port 37012: Too many authentication failures [preauth]
Jun 15 21:33:26 www sshd[31931]: Failed password for git from 218.81.128.80 port 37146 ssh2
Jun 15 21:33:26 www sshd[31931]: Failed password for git from 218.81.128.80 port 37146 ssh2
Jun 15 21:33:26 www sshd[31931]: error: maximum authentication attempts exceeded for git from 218.81.128.80 port 37146 ssh2 [preauth]
Jun 15 21:33:26 www sshd[31931]: Disconnecting authenticating user git 218.81.128.80 port 37146: Too many authentication failures [preauth]
Jun 15 21:53:26 www sshd[870]: Failed password for git from 101.81.237.208 port 37384 ssh2
Jun 15 21:53:26 www sshd[870]: Failed password for git from 101.81.237.208 port 37384 ssh2
Jun 15 21:53:26 www sshd[870]: error: maximum authentication attempts exceeded for git from 101.81.237.208 port 37384 ssh2 [preauth]
Jun 15 21:53:26 www sshd[870]: Disconnecting authenticating user git 101.81.237.208 port 37384: Too many authentication failures [preauth]
i'm using pycharm/phpstorm etc and set a git server on my server.
i've checked the settings of this 2 software and have no idea what is happening. I even changed my computer but made no difference.
ssh
asked 11 hours ago
Charles BaoCharles Bao
1213
New contributor
Charles Bao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Based on IP, check whether it's yours or not. Use WHOIS services to find from where they are. If these IP addresses are public, then it's probably someone else, trying to clone some Git repositories from your server.
– kenorb
11 hours ago
@kenorb it's my private IP. Just 10-20 minutes after i started to work, the annoying things happend. How about delete git user?
– Charles Bao
10 hours ago
add a comment |
I use key (not password) to do the ssh.
But my ip frequently banned by server.
After look into the server auth.log.
I found someone(software) is doing the ssh with wrong password every 10-20 minutes.
Jun 15 21:23:26 www sshd[31046]: Failed password for git from 218.81.128.80 port 37012 ssh2
Jun 15 21:23:26 www sshd[31046]: error: maximum authentication attempts exceeded for git from 218.81.128.80 port 37012 ssh2 [preauth]
Jun 15 21:23:26 www sshd[31046]: Disconnecting authenticating user git 218.81.128.80 port 37012: Too many authentication failures [preauth]
Jun 15 21:33:26 www sshd[31931]: Failed password for git from 218.81.128.80 port 37146 ssh2
Jun 15 21:33:26 www sshd[31931]: Failed password for git from 218.81.128.80 port 37146 ssh2
Jun 15 21:33:26 www sshd[31931]: error: maximum authentication attempts exceeded for git from 218.81.128.80 port 37146 ssh2 [preauth]
Jun 15 21:33:26 www sshd[31931]: Disconnecting authenticating user git 218.81.128.80 port 37146: Too many authentication failures [preauth]
Jun 15 21:53:26 www sshd[870]: Failed password for git from 101.81.237.208 port 37384 ssh2
Jun 15 21:53:26 www sshd[870]: Failed password for git from 101.81.237.208 port 37384 ssh2
Jun 15 21:53:26 www sshd[870]: error: maximum authentication attempts exceeded for git from 101.81.237.208 port 37384 ssh2 [preauth]
Jun 15 21:53:26 www sshd[870]: Disconnecting authenticating user git 101.81.237.208 port 37384: Too many authentication failures [preauth]
i'm using pycharm/phpstorm etc and set a git server on my server.
i've checked the settings of this 2 software and have no idea what is happening. I even changed my computer but made no difference.
ssh
asked 11 hours ago
Charles BaoCharles Bao
1213
New contributor
Charles Bao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I use key (not password) to do the ssh.
But my ip frequently banned by server.
After look into the server auth.log.
I found someone(software) is doing the ssh with wrong password every 10-20 minutes.
Jun 15 21:23:26 www sshd[31046]: Failed password for git from 218.81.128.80 port 37012 ssh2
Jun 15 21:23:26 www sshd[31046]: error: maximum authentication attempts exceeded for git from 218.81.128.80 port 37012 ssh2 [preauth]
Jun 15 21:23:26 www sshd[31046]: Disconnecting authenticating user git 218.81.128.80 port 37012: Too many authentication failures [preauth]
Jun 15 21:33:26 www sshd[31931]: Failed password for git from 218.81.128.80 port 37146 ssh2
Jun 15 21:33:26 www sshd[31931]: Failed password for git from 218.81.128.80 port 37146 ssh2
Jun 15 21:33:26 www sshd[31931]: error: maximum authentication attempts exceeded for git from 218.81.128.80 port 37146 ssh2 [preauth]
Jun 15 21:33:26 www sshd[31931]: Disconnecting authenticating user git 218.81.128.80 port 37146: Too many authentication failures [preauth]
Jun 15 21:53:26 www sshd[870]: Failed password for git from 101.81.237.208 port 37384 ssh2
Jun 15 21:53:26 www sshd[870]: Failed password for git from 101.81.237.208 port 37384 ssh2
Jun 15 21:53:26 www sshd[870]: error: maximum authentication attempts exceeded for git from 101.81.237.208 port 37384 ssh2 [preauth]
Jun 15 21:53:26 www sshd[870]: Disconnecting authenticating user git 101.81.237.208 port 37384: Too many authentication failures [preauth]
i'm using pycharm/phpstorm etc and set a git server on my server.
i've checked the settings of this 2 software and have no idea what is happening. I even changed my computer but made no difference.
ssh
ssh
asked 11 hours ago
Charles BaoCharles Bao
1213
New contributor
Charles Bao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 11 hours ago
Charles BaoCharles Bao
1213
New contributor
Charles Bao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 11 hours ago
Charles BaoCharles Bao
1213
New contributor
Charles Bao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 11 hours ago
Charles BaoCharles Bao
1213
asked 11 hours ago
Charles BaoCharles Bao
1213
1213
New contributor
Charles Bao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Charles Bao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Based on IP, check whether it's yours or not. Use WHOIS services to find from where they are. If these IP addresses are public, then it's probably someone else, trying to clone some Git repositories from your server.
– kenorb
11 hours ago
@kenorb it's my private IP. Just 10-20 minutes after i started to work, the annoying things happend. How about delete git user?
– Charles Bao
10 hours ago
add a comment |
Based on IP, check whether it's yours or not. Use WHOIS services to find from where they are. If these IP addresses are public, then it's probably someone else, trying to clone some Git repositories from your server.
– kenorb
11 hours ago
@kenorb it's my private IP. Just 10-20 minutes after i started to work, the annoying things happend. How about delete git user?
– Charles Bao
10 hours ago
Based on IP, check whether it's yours or not. Use WHOIS services to find from where they are. If these IP addresses are public, then it's probably someone else, trying to clone some Git repositories from your server.
– kenorb
11 hours ago
Based on IP, check whether it's yours or not. Use WHOIS services to find from where they are. If these IP addresses are public, then it's probably someone else, trying to clone some Git repositories from your server.
– kenorb
11 hours ago
@kenorb it's my private IP. Just 10-20 minutes after i started to work, the annoying things happend. How about delete git user?
– Charles Bao
10 hours ago
@kenorb it's my private IP. Just 10-20 minutes after i started to work, the annoying things happend. How about delete git user?
– Charles Bao
10 hours ago
add a comment |
2 Answers
2
active
oldest
votes
sudo lsof | grep ssh | grep git| grep IPv4 on the client machine that's doing it should tell you what's doing it at the time.
lsof will tell you what's using a file (and everything is a file in *nix). We're filtering for ssh and your username and IPv4 connections
You would need to do this while your system is trying to log in.
Simply removing the git user would likely just hide the problem - since there's something running that's sshing into the other machine.
answered 10 hours ago
Journeyman Geek♦Journeyman Geek
114k44220377
i tried, actually i can't catch the exact time of login event.
– Charles Bao
10 hours ago
add a comment |
Actually i found the answer.
It's a pycharm plugin called Git Integration.
After i disabled this plugin, problem solved.
answered 9 hours ago
Charles BaoCharles Bao
1213
New contributor
Charles Bao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "3"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Charles Bao is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1449116%2fhow-to-find-which-software-is-doing-ssh-connection%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
sudo lsof | grep ssh | grep git| grep IPv4 on the client machine that's doing it should tell you what's doing it at the time.
lsof will tell you what's using a file (and everything is a file in *nix). We're filtering for ssh and your username and IPv4 connections
You would need to do this while your system is trying to log in.
Simply removing the git user would likely just hide the problem - since there's something running that's sshing into the other machine.
answered 10 hours ago
Journeyman Geek♦Journeyman Geek
114k44220377
i tried, actually i can't catch the exact time of login event.
– Charles Bao
10 hours ago
add a comment |
sudo lsof | grep ssh | grep git| grep IPv4 on the client machine that's doing it should tell you what's doing it at the time.
lsof will tell you what's using a file (and everything is a file in *nix). We're filtering for ssh and your username and IPv4 connections
You would need to do this while your system is trying to log in.
Simply removing the git user would likely just hide the problem - since there's something running that's sshing into the other machine.
answered 10 hours ago
Journeyman Geek♦Journeyman Geek
114k44220377
i tried, actually i can't catch the exact time of login event.
– Charles Bao
10 hours ago
add a comment |
sudo lsof | grep ssh | grep git| grep IPv4 on the client machine that's doing it should tell you what's doing it at the time.
lsof will tell you what's using a file (and everything is a file in *nix). We're filtering for ssh and your username and IPv4 connections
You would need to do this while your system is trying to log in.
Simply removing the git user would likely just hide the problem - since there's something running that's sshing into the other machine.
answered 10 hours ago
Journeyman Geek♦Journeyman Geek
114k44220377
sudo lsof | grep ssh | grep git| grep IPv4 on the client machine that's doing it should tell you what's doing it at the time.
lsof will tell you what's using a file (and everything is a file in *nix). We're filtering for ssh and your username and IPv4 connections
You would need to do this while your system is trying to log in.
Simply removing the git user would likely just hide the problem - since there's something running that's sshing into the other machine.
answered 10 hours ago
Journeyman Geek♦Journeyman Geek
114k44220377
answered 10 hours ago
Journeyman Geek♦Journeyman Geek
114k44220377
answered 10 hours ago
Journeyman Geek♦Journeyman Geek
114k44220377
answered 10 hours ago
Journeyman Geek♦Journeyman Geek
114k44220377
114k44220377
i tried, actually i can't catch the exact time of login event.
– Charles Bao
10 hours ago
add a comment |
i tried, actually i can't catch the exact time of login event.
– Charles Bao
10 hours ago
i tried, actually i can't catch the exact time of login event.
– Charles Bao
10 hours ago
i tried, actually i can't catch the exact time of login event.
– Charles Bao
10 hours ago
add a comment |
Actually i found the answer.
It's a pycharm plugin called Git Integration.
After i disabled this plugin, problem solved.
answered 9 hours ago
Charles BaoCharles Bao
1213
New contributor
Charles Bao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
Actually i found the answer.
It's a pycharm plugin called Git Integration.
After i disabled this plugin, problem solved.
answered 9 hours ago
Charles BaoCharles Bao
1213
New contributor
Charles Bao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
Actually i found the answer.
It's a pycharm plugin called Git Integration.
After i disabled this plugin, problem solved.
answered 9 hours ago
Charles BaoCharles Bao
1213
New contributor
Charles Bao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Actually i found the answer.
It's a pycharm plugin called Git Integration.
After i disabled this plugin, problem solved.
answered 9 hours ago
Charles BaoCharles Bao
1213
New contributor
Charles Bao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 9 hours ago
Charles BaoCharles Bao
1213
New contributor
Charles Bao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 9 hours ago
Charles BaoCharles Bao
1213
answered 9 hours ago
Charles BaoCharles Bao
1213
1213
New contributor
Charles Bao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Charles Bao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
add a comment |
Charles Bao is a new contributor. Be nice, and check out our Code of Conduct.
Charles Bao is a new contributor. Be nice, and check out our Code of Conduct.
Charles Bao is a new contributor. Be nice, and check out our Code of Conduct.
Charles Bao is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1449116%2fhow-to-find-which-software-is-doing-ssh-connection%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Based on IP, check whether it's yours or not. Use WHOIS services to find from where they are. If these IP addresses are public, then it's probably someone else, trying to clone some Git repositories from your server.
– kenorb
11 hours ago
@kenorb it's my private IP. Just 10-20 minutes after i started to work, the annoying things happend. How about delete git user?
– Charles Bao
10 hours ago