var sidebar_align = 'right';
var content_container_margin = parseInt('350px');
var sidebar_width = parseInt('330px');
What does this mean:
Users logging in through sshd:
wmp logged in from h001095a9ce88.ne.client2.attbi.com (xxx.xx.xxx) using password: 1 Time(s)
SFTP subsystem requests: 1 Time(s)
It means that user wmp login from hostmask h001095a9ce88.ne.client2.attbi.com and IP (xxx.xxx.xxx.xxx) using the correct password once, and this is a SFTP connection (which uses the sshd service)
so is it saying he logged into shell? This client is a personal friend of mine, and i've been hosting him for a few months now, but this is the very first time i got this message.
Sounds like he used either an SFTP client like ws_ftp or winscp to connect rather than logging into shell.
You can check /var/log/secure and if the wmp entries are at the same time then he used an SFTP client to connect.