question about VPS mail in freebsd14.2 ?

Dear all:
my vps got a mail in my travel time in below .

Message 40:
From root@iZf8z7jt2n2h7jopce0widZ Sun May 4 03:33:06 2025
To: root
Subject: iZf8z7jt2n2h7jopce0widZ daily security run output
Date: Sun, 04 May 2025 03:33:06 +0800
From: <root@iZf8z7jt2n2h7jopce0widZ>


Checking setuid files and devices:
Checking negative group permissions:
Checking for uids of 0:
root 0
toor 0

Checking for passwordless accounts:
Checking login.conf permissions:
iZf8z7jt2n2h7jopce0widZ pf denied packets:
+block drop all [ Evaluations: 4898 Packets: 4884 Bytes: 288422 States: 0 ]

iZf8z7jt2n2h7jopce0widZ login failures:
iZf8z7jt2n2h7jopce0widZ refused connections:

Checking for security vulnerabilities in base (userland & kernel):
pkg: An error occured while fetching package: No error
pkg: cannot fetch vulnxml file
pkg: An error occured while fetching package: No error
pkg: cannot fetch vulnxml file

Checking for packages with security vulnerabilities:
pkg: An error occured while fetching package: No error
pkg: cannot fetch vulnxml file

Checking for packages with mismatched checksums:

-- End of security output --


question :
1. in that day, i have never try to login it . who try login and check my user account infomation ?
2. who check my system file system and device ?
3. who check security vulnerabilies in base (userland and kernel ) ? looks like the freebsd14.2 auto made it ? right ?

note: my crontab was no job configure about user account info checking, and scan device, security daily check.

thanks.
 
dear all:
my vps belongs to aliyun china site. looks like this vps full control by aliyun. because, when i install freebsd14.2 to this vps. aliyun must bind a sshkey for this vps. so this guy use this sshkey with root to control my vps , right ? i think that was no good and security ... any other vps was working same like me ? thanks.
 
Look at the subject of the email.
daily security run output

see /etc/crontab, periodic(8), /etc/periodic/daily/450.status-security, /etc/periodic/security/, /usr/local/etc/periodic.
 
Back
Top