Detect intruders or non-authorized users?

[Niclas]

Last night I detected high traffic on my PowerLAN adapter and saw that my Raspberry was the reason for it. Since the attached USB device was active it was an indicator of someone accessing my Seafile data.

Thus I immediately logged on at the webinterface to check for connected clients but there was none listed, except for mine (the other accounts' last connections had been one or more days before). Afterwards I quickly checked the Seafile logs (ccnet, Seafile, Seahub) but no user was listed excecpt for me. Only the entry "Unknown peer ............ connected" made me wonder. Unfortunately the long number is useless since I needed an IP or username to identify the connection.

Then I used the "users" command in the terminal to check for connected users (root access is prohibited) but only I was logged in.

Since I wasn't able to get a clear information who was connected and why I immediately stopped seahub.sh and seafile.sh and the traffice stopped.

Which ways are there to clearly see who is doing what and who is accessing my data? I'd like to see at the first point of view what's happening on my server and if there are any non-authorized connections.

[Shuai Lin]

This forum is deprecated, please go to https://forum.seafile-server.org .

--
You received this message because you are subscribed to the Google Groups "seafile" group.
To unsubscribe from this group and stop receiving emails from it, send an email to seafile+u...@googlegroups.com.
To post to this group, send email to sea...@googlegroups.com.
Visit this group at https://groups.google.com/group/seafile.
For more options, visit https://groups.google.com/d/optout.