Unexplained SSH Activity on Fresh Install

Hi @sahsanu,

As per my last comment.

Production (v1.8.12):

# rrdtool info /usr/local/hestia/web/rrd/ssh/ssh.rrd
filename = "/usr/local/hestia/web/rrd/ssh/ssh.rrd"
rrd_version = "0003"
step = 300
last_update = 1740296102
header_size = 2040
ds[A].index = 0
ds[A].type = "GAUGE"
ds[A].minimal_heartbeat = 600
ds[A].min = NaN
ds[A].max = NaN
ds[A].last_ds = "2"
ds[A].value = 4.2418120000e+00
ds[A].unknown_sec = 0
rra[0].cf = "AVERAGE"
rra[0].rows = 600
rra[0].cur_row = 571
rra[0].pdp_per_row = 1
rra[0].xff = 5.0000000000e-01
rra[0].cdp_prep[0].value = NaN
rra[0].cdp_prep[0].unknown_datapoints = 0
rra[1].cf = "AVERAGE"
rra[1].rows = 700
rra[1].cur_row = 637
rra[1].pdp_per_row = 6
rra[1].xff = 5.0000000000e-01
rra[1].cdp_prep[0].value = 1.9862888267e+00
rra[1].cdp_prep[0].unknown_datapoints = 0
rra[2].cf = "AVERAGE"
rra[2].rows = 775
rra[2].cur_row = 355
rra[2].pdp_per_row = 24
rra[2].xff = 5.0000000000e-01
rra[2].cdp_prep[0].value = 1.9862888267e+00
rra[2].cdp_prep[0].unknown_datapoints = 0
rra[3].cf = "AVERAGE"
rra[3].rows = 797
rra[3].cur_row = 110
rra[3].pdp_per_row = 288
rra[3].xff = 5.0000000000e-01
rra[3].cdp_prep[0].value = 1.9862888267e+00
rra[3].cdp_prep[0].unknown_datapoints = 0
rra[4].cf = "MAX"
rra[4].rows = 600
rra[4].cur_row = 167
rra[4].pdp_per_row = 1
rra[4].xff = 5.0000000000e-01
rra[4].cdp_prep[0].value = NaN
rra[4].cdp_prep[0].unknown_datapoints = 0
rra[5].cf = "MAX"
rra[5].rows = 700
rra[5].cur_row = 85
rra[5].pdp_per_row = 6
rra[5].xff = 5.0000000000e-01
rra[5].cdp_prep[0].value = 1.9862888267e+00
rra[5].cdp_prep[0].unknown_datapoints = 0
rra[6].cf = "MAX"
rra[6].rows = 775
rra[6].cur_row = 478
rra[6].pdp_per_row = 24
rra[6].xff = 5.0000000000e-01
rra[6].cdp_prep[0].value = 1.9862888267e+00
rra[6].cdp_prep[0].unknown_datapoints = 0
rra[7].cf = "MAX"
rra[7].rows = 797
rra[7].cur_row = 107
rra[7].pdp_per_row = 288
rra[7].xff = 5.0000000000e-01
rra[7].cdp_prep[0].value = 1.9862888267e+00
rra[7].cdp_prep[0].unknown_datapoints = 0

# rrdtool fetch /usr/local/hestia/web/rrd/ssh/ssh.rrd AVERAGE --start -2hour
                              A

1740289500: 0.0000000000e+00
1740289800: 0.0000000000e+00
1740290100: 0.0000000000e+00
1740290400: 0.0000000000e+00
1740290700: 0.0000000000e+00
1740291000: 0.0000000000e+00
1740291300: 0.0000000000e+00
1740291600: 0.0000000000e+00
1740291900: 0.0000000000e+00
1740292200: 0.0000000000e+00
1740292500: 0.0000000000e+00
1740292800: 0.0000000000e+00
1740293100: 0.0000000000e+00
1740293400: 0.0000000000e+00
1740293700: 0.0000000000e+00
1740294000: 0.0000000000e+00
1740294300: 0.0000000000e+00
1740294600: 0.0000000000e+00
1740294900: 0.0000000000e+00
1740295200: 0.0000000000e+00
1740295500: 0.0000000000e+00
1740295800: 0.0000000000e+00
1740296100: 1.9862888267e+00
1740296400: 2.0000000000e+00
1740296700: nan

# v-list-cron-jobs admin
JOB  MIN  HOUR  MONTH  WDAY  COMMAND
---  ---  ----  -----  ----  -------
1    */2  *     *      *     sudo /usr/local/hestia/bin/v-update-sys-queue restart
2    10   00    *      *     sudo /usr/local/hestia/bin/v-update-sys-queue daily
3    15   02    *      *     sudo /usr/local/hestia/bin/v-update-sys-queue disk
4    10   00    *      *     sudo /usr/local/hestia/bin/v-update-sys-queue traffic
5    30   03    *      *     sudo /usr/local/hestia/bin/v-update-sys-queue webstats
6    */5  *     *      *     sudo /usr/local/hestia/bin/v-update-sys-queue backup
7    10   05    *      *     sudo /usr/local/hestia/bin/v-backup-users
8    20   00    *      *     sudo /usr/local/hestia/bin/v-update-user-stats
9    */5  *     *      *     sudo /usr/local/hestia/bin/v-update-sys-rrd
10   21   3     *      *     sudo /usr/local/hestia/bin/v-update-letsencrypt-ssl
11   55   23    *      *     sudo apt autoremove -y

Staging (v1.9.2):

# rrdtool info /usr/local/hestia/web/rrd/ssh/ssh.rrd
filename = "/usr/local/hestia/web/rrd/ssh/ssh.rrd"
rrd_version = "0003"
step = 300
last_update = 1740296102
header_size = 2040
ds[A].index = 0
ds[A].type = "GAUGE"
ds[A].minimal_heartbeat = 600
ds[A].min = NaN
ds[A].max = NaN
ds[A].last_ds = "2"
ds[A].value = 4.0841340000e+00
ds[A].unknown_sec = 0
rra[0].cf = "AVERAGE"
rra[0].rows = 600
rra[0].cur_row = 154
rra[0].pdp_per_row = 1
rra[0].xff = 5.0000000000e-01
rra[0].cdp_prep[0].value = NaN
rra[0].cdp_prep[0].unknown_datapoints = 0
rra[1].cf = "AVERAGE"
rra[1].rows = 700
rra[1].cur_row = 130
rra[1].pdp_per_row = 6
rra[1].xff = 5.0000000000e-01
rra[1].cdp_prep[0].value = 1.9872279400e+00
rra[1].cdp_prep[0].unknown_datapoints = 0
rra[2].cf = "AVERAGE"
rra[2].rows = 775
rra[2].cur_row = 745
rra[2].pdp_per_row = 24
rra[2].xff = 5.0000000000e-01
rra[2].cdp_prep[0].value = 1.9872279400e+00
rra[2].cdp_prep[0].unknown_datapoints = 0
rra[3].cf = "AVERAGE"
rra[3].rows = 797
rra[3].cur_row = 219
rra[3].pdp_per_row = 288
rra[3].xff = 5.0000000000e-01
rra[3].cdp_prep[0].value = 1.9872279400e+00
rra[3].cdp_prep[0].unknown_datapoints = 0
rra[4].cf = "MAX"
rra[4].rows = 600
rra[4].cur_row = 395
rra[4].pdp_per_row = 1
rra[4].xff = 5.0000000000e-01
rra[4].cdp_prep[0].value = NaN
rra[4].cdp_prep[0].unknown_datapoints = 0
rra[5].cf = "MAX"
rra[5].rows = 700
rra[5].cur_row = 380
rra[5].pdp_per_row = 6
rra[5].xff = 5.0000000000e-01
rra[5].cdp_prep[0].value = 1.9872279400e+00
rra[5].cdp_prep[0].unknown_datapoints = 0
rra[6].cf = "MAX"
rra[6].rows = 775
rra[6].cur_row = 164
rra[6].pdp_per_row = 24
rra[6].xff = 5.0000000000e-01
rra[6].cdp_prep[0].value = 1.9872279400e+00
rra[6].cdp_prep[0].unknown_datapoints = 0
rra[7].cf = "MAX"
rra[7].rows = 797
rra[7].cur_row = 775
rra[7].pdp_per_row = 288
rra[7].xff = 5.0000000000e-01
rra[7].cdp_prep[0].value = 1.9872279400e+00
rra[7].cdp_prep[0].unknown_datapoints = 0

# rrdtool fetch /usr/local/hestia/web/rrd/ssh/ssh.rrd AVERAGE --start -2hour
                              A

1740289500: 0.0000000000e+00
1740289800: 0.0000000000e+00
1740290100: 0.0000000000e+00
1740290400: 0.0000000000e+00
1740290700: 0.0000000000e+00
1740291000: 0.0000000000e+00
1740291300: 0.0000000000e+00
1740291600: 0.0000000000e+00
1740291900: 0.0000000000e+00
1740292200: 0.0000000000e+00
1740292500: 0.0000000000e+00
1740292800: 0.0000000000e+00
1740293100: 0.0000000000e+00
1740293400: 0.0000000000e+00
1740293700: 0.0000000000e+00
1740294000: 0.0000000000e+00
1740294300: 0.0000000000e+00
1740294600: 0.0000000000e+00
1740294900: 0.0000000000e+00
1740295200: 0.0000000000e+00
1740295500: 0.0000000000e+00
1740295800: 0.0000000000e+00
1740296100: 1.9872279400e+00
1740296400: 2.0000000000e+00
1740296700: nan

As Staging is running on v1.9.2 and given this post, the output of v-list-cron-jobs admin is empty. Anyhow, this is the list of allk cronjobs in staging:

*/2 * * * * sudo /usr/local/hestia/bin/v-update-sys-queue restart
10 00 * * * sudo /usr/local/hestia/bin/v-update-sys-queue daily
15 02 * * * sudo /usr/local/hestia/bin/v-update-sys-queue disk
10 00 * * * sudo /usr/local/hestia/bin/v-update-sys-queue traffic
30 03 * * * sudo /usr/local/hestia/bin/v-update-sys-queue webstats
*/5 * * * * sudo /usr/local/hestia/bin/v-update-sys-queue backup
10 05 * * * sudo /usr/local/hestia/bin/v-backup-users
20 00 * * * sudo /usr/local/hestia/bin/v-update-user-stats
*/5 * * * * sudo /usr/local/hestia/bin/v-update-sys-rrd
12 7 * * * sudo /usr/local/hestia/bin/v-update-letsencrypt-ssl

As you can see these are the default ones as this is a fresh deployment.