VMware Cloud Community
CSCTOOL
Contributor
Contributor

SSH service enables itself

Every morning for the last few days, the vCenter console shows all of our Hosts has SSH enabled. On every host, the service is set to manual. Every day I disable the service, yet every night a service account enables it again with the logs showing vim.event.RemoteTSMEnabledEvent

This has happened three nights in a row.

Any ideas? Is there something more nefarious going on?

 

Thanks

Labels (1)
Reply
0 Kudos
1 Reply
fabio1975
Commander
Commander

Ciao 

Have you checked if any accesses have been made via SSH to the servers?
The first thing I would do is check if anyone logged in via ssh during the time the SSH service was active
To verify this, you can look at the auth.log log file located on each host in /var/log

 

 

Fabio

Visit vmvirtual.blog
If you're satisfied give me a kudos

Reply
0 Kudos