On Fri, 2011-11-18 at 21:14 +0530, Abhijeet Nagawade wrote: > My port 22 for ssh was open and root login enabled via SSH > > > I checked /var/log/secure and found login by some IP addresses never > used by me. > > > IP Lookup showed those IP belonging to south america. > Formatted the machine and disabled root login via SSH also blocked > port 22 on router (WAN) If I need SSH I always reassign it to a non-standard port. Paul.