Over the weekend we got alerts on technician login failure, however the information provided on the email alert only shows an IP and port. Is there any log we can check on the server (linux server) to get a more complete report on these alerts?
From Server Log we only see a very limited log information and so far have not found anything related to the email Alert we got.
I don’t know what additional information you think Simple-Help would have. The login failed, so all it would have is the IP and time.
What this does mean though is that someone went through the time of going to your simple-help site and then downloading technician program, installing it, and then trying a user. That is more than a drive-by, could be someone that was curious, but not a bot.
You may want to make sure that you are on latest release, and have mfa on all logins, also not a bad idea to change default admin user for Simple-Help Server (if you haven’t already). Also make sure OS is fully up to date. If the ip was from another country you are cloud hosting you may be able to do some geo-blocking to help also.
Remote Support
Remote Access
Monitoring and Management
Presentation
Remote Work
Standard
Business
Enterprise