Just checked out the logs on my RG
Apparently SSH was enabled right after CWMP disconnected as I can connect to it (I cannot login to it obviously) and the port is open on the WAN side.
I found the logs to be reporting this:
2014-11-21T09:44:05-06:00 L5 sdb[332]: disable service: ssh
2014-11-21T09:44:05-06:00 L5 sdb[332]: disable service: telnet
2014-11-21T09:44:05-06:00 L5 sdb[332]: enable service: ssh
along with this about 1-2 hours later
2014-11-21T11:01:24-06:00 L4 cshell[1755]: TS: "remotessh" completed login via SSH from 152
2014-11-21T11:01:25-06:00 L4 cshell[1755]: TS: "remotessh" disconnected from shell
There has been 3 SSH logins and disconnects.
The port is not listed as being forwarded or anything on the firewall.
Is this happening to anyone else? Has AT&T started doing this?
↧