Unknown Host SSHD Connection: "Notty" Solved

[Prioria]

I just had an interesting occurrence. I was checking a Linux server's processes and noticed that it's memory & CPU usage was very high. I checked HTOP and saw that there were 2 sshd connections running sftp-server processes from an unknown host named "notty". I immediately killed the processes and started researching "notty". I found a few forums online that mention this happening but no real answers, and lots of dead links.

What I found out was these sshd connections were coming from our Barracuda backup server. I knew that Barracuda uses ssh to backup Linux boxes but hadn't noticed these connections before. So this is just an updated post about this issue. I don't know why Barracuda uses the name "notty" but if you run across this issue and see "notty" as an sshd host, it is not an intruder, it is most likely an automated connection from another server.

I am glad to have figured this out as quickly as I did and didn't shut down the server for security purposes. It is a scary feeling thinking that you have ssh connections from an unknown host transferring files from your server via sftp.

[ryokimball]

Very good of you to post this. I'm sure "notty" is for no-tty or some other meaningful thing, but I read it as some cheeky invader who couldn't spell "naughty."