I have 2.9rc7, which I upgraded from 2.8.28
I was subject to some form of password attack yesterday and as expected there was the usual result for the attacker, however as can be seen from the last two entries in the log pasted below, a login was succesful using the account test. This is strange as the only test account I had was a pppoe secrets account, which at the time was disabled. I then used a secure shell (via putty) to try to log on to the router using test and I was successful. On removing the account test , I could no longer access the router using test. I then readded the pppoe test account in secrets and found that I could log in whether the account was enabled or disabled, I could then make changes to the routers configuration. I nearly forgot to mention that the password of the pppoe test account was test, if I changed the password to something else, I then could not log into the router. I know that it was silly of me to use test as a userid and password, but thats why it was disabled, and I didn’t expect it to allow me to login to the router configuration. How is that possible?
jul/29 19:37:02 system,error,critical login failure for user arthur from 61.111.255.33 via ssh
jul/29 19:37:05 system,error,critical login failure for user fred from 61.111.255.33 via ssh
jul/29 19:37:09 system,error,critical login failure for user greg from 61.111.255.33 via ssh
jul/29 19:37:13 system,error,critical login failure for user steve from 61.111.255.33 via ssh
jul/29 19:37:17 system,error,critical login failure for user felix from 61.111.255.33 via ssh
jul/29 19:37:21 system,error,critical login failure for user sandra from 61.111.255.33 via ssh
jul/29 19:37:24 system,error,critical login failure for user security from 61.111.255.33 via ssh
jul/29 19:37:29 system,error,critical login failure for user chris from 61.111.255.33 via ssh
jul/29 19:37:32 system,error,critical login failure for user gabriel from 61.111.255.33 via ssh
jul/29 19:37:36 system,error,critical login failure for user dennis from 61.111.255.33 via ssh
jul/29 19:37:40 system,error,critical login failure for user mysql from 61.111.255.33 via ssh
jul/29 19:37:44 system,error,critical login failure for user mysql from 61.111.255.33 via ssh
jul/29 19:37:47 system,error,critical login failure for user mac from 61.111.255.33 via ssh
jul/29 19:37:51 system,error,critical login failure for user samba from 61.111.255.33 via ssh
jul/29 19:37:55 system,error,critical login failure for user martin from 61.111.255.33 via ssh
jul/29 19:37:58 system,error,critical login failure for user alan from 61.111.255.33 via ssh
jul/29 19:38:02 system,error,critical login failure for user allan from 61.111.255.33 via ssh
jul/29 19:38:06 system,error,critical login failure for user karl from 61.111.255.33 via ssh
jul/29 19:38:10 system,error,critical login failure for user test from 61.111.255.33 via ssh
jul/29 19:38:14 system,error,critical login failure for user test from 61.111.255.33 via ssh
jul/29 19:38:19 system,info,account user test logged in from 61.111.255.33 via ssh
jul/29 19:38:25 system,info,account user test logged out from 61.111.255.33 via ssh