I have faced a problem with my VPS. It seems that someone has added his public key to my authorized_keys file and logged in to my VPS.
Postponed publickey for xxx from 223.255.145.158 port 52240 ssh2 [preauth]
debug1: userauth-request for user root service ssh-connection method publickey [preauth]
debug1: attempt 2 failures 0 [preauth]
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: trying public key file /xxx/.ssh/authorized_keys
debug1: fd 4 clearing O_NONBLOCK
debug1: read_keyfile_line: /xxx/.ssh/authorized_keys line 1 exceeds size limit
debug1: matching key found: file /xxx/.ssh/authorized_keys, line 6 RSA 63:26:51:7d:bb:fb:a7:6b:7a:a8:93:a9:25:91:c4:06
debug1: restore_uid: 0/0
debug1: ssh_rsa_verify: signature correct
debug1: do_pam_account: called
Accepted publickey for xxx from 223.255.145.158 port 52240 ssh2: RSA 63:26:51:7d:bb:fb:a7:6b:7a:a8:93:a9:25:91:c4:06
debug1: monitor_child_preauth: xxx has been authenticated by privileged process
debug1: monitor_read_log: child log fd closed
debug1: PAM: establishing credentials
Further information - I am enabling ssh authentication using both keys and passwords.
Any idea why this kind of issue happened in my VPS?