0

Recently I've set up my home server with Ubuntu 22.04.4 LTS. It was running just fine for around a week or so with only Minecraft server hosted on it. The problem is that after around a week of uptime I can't login via ssh or physically on the computer even though the password is 100% correct - always getting "Invalid password" message. I've had created a separate account for pure minecraft purpose and I can't login to that account also. I've tried logging in via tty3 but it doesn't work either. Strange thing is that after a reboot, new account named "Cheeki" appears on login screen.

I want to note that it's the second that that such thing happened. First time the situation was exactly the same, but with Ubuntu Server installed - around a week of uptime and I can't login with any method (also the same user named "Cheeki" was created without my knowledge).

Just to make clear that I've tried many different things including logging in as root user via recovery mode by modifying the boot command which didn't succeed (I couldn't perform any action) and first attempt ended with complete format and installation of Ubuntu Desktop. I thought that having an access to Desktop version of login screen might help, but as the time shows the situation is exactly the same. Many forums and stack threads were checked by me but I couldn't really find any answer to the problem.

Additional info: the only thing running on the machine is minecraft server. Nobody changed any credentials without my knowledge, basically no one logged in to the machine besides me and there's no possible way of creating that additional user that I wouldn't be aware of.

I was planning on hosting Gitlab instance on the server but without any access and the situation repeating for the second time it's not a thing until I figure out what's going on. Did someone encounter a similar situation or might have an idea what's going on with my machine? Every comment is valuable and I will be thankful for each suggestion!

5
  • 4
    You have suffered a computer breakin. The creation of a new login account shows this. Disconnect from the network, reboot with the Shift key held, Advanced->Single User Mode. Start with `cat /etc/passwd;cat /etc/group``, investigate the new user.
    – waltinator
    Commented Apr 18 at 20:21
  • 2
    Nuke it and start over, with better security. Commented Apr 18 at 20:27
  • If you are 100% sure no one could ever possibly have had physical access to the machine / to your credentials, that no one could ever possibly have guessed your password (and this is the second time this happens) etc... Then the Minecraft server starts to raise some suspicions. Which system user was running the server? Is the Minecraft server up to date? Other than that Ubuntu has sane configuration defaults, it's hard to think they could have broke an active default service.
    – kos
    Commented Apr 18 at 20:35
  • is the minecraft server running as root?
    – Rinzwind
    Commented Apr 19 at 7:38
  • Thanks everyone for the comments. To answer some questions - I've created separate user with root permission to be running minecraft server and that might have been a mistake. I will start fresh once again, this time trying to be more careful with all security stuff.
    – BlackFlage
    Commented Apr 19 at 19:31

0

You must log in to answer this question.

Browse other questions tagged .