Who is "user: 0"?

Hi all, during an attack to my traccar server, someone created fake users on it.
I've got log entries like this:

2024-08-26 17:29:53  INFO: user: 0, action: create, object: user, id: 2
2024-08-26 17:29:53  INFO: user: 2, action: login, from: 217.X.Y.Z
2024-08-26 17:29:53  INFO: user: 2, action: create, object: device, id: 6
2024-08-26 17:29:53  INFO: user: 2, action: link, owner: user, id: 2, property: device, id: 6

On this server there is a single real user, identified as "user 1" with a very hard-to-guess password, but I've no knowledge
of an "user 0' in version 5.12 of Traccar... as it was at the time of the attack

Can someone explain to me what is this and how to prevent this kind of problems?

Thanks in advance.

Do you have registration enabled? User 0 means that it's simply a normal registration by a user.

Registration is disabled after update to 6.5... Can't really say if it was or it wasn't disabled in the past...
Ok, thank for the answer, now I've understood what it means.

BTW, what are the best practices for hardening a Traccar server?

Thanks & bye

Disabling registration is one if you don't want user self registration. Other than that you can disable unused ports. If you want to go even further, you can set up something like fail2ban.

I've setup fail2ban for Traccar, but doesn't seems to be very effective... I'm searching docs for port disabling & a fail2ban setup better than mine :)
Thanks