The system runs a SSH daemon, and a nginx web server, both ports being open to the internet. We are part of a university so our ports are forwarded from the main router to the intranet.
At about 19:00, the SSH daemon stops responding to all requests for login. All passwords as well as SSH keys seem invalid. We responded by taking the machine offline two hours after the incident, just in case it was more than a "glitch".
I also checked the daemon logs, and there is no reason to suspect the process was killed, as it was still responding to password requests, just not allowing any user to login given correct credentials.
I've ruled out user error by looking through the shell history files. The only other option is that we were attacked. So my question is: is this a glitch with OpenSSH, or was my system breached?
I realize this is a very broad question with not much details, so I will provide any further information upon request.
EDIT Running On Fedora 20 Heisenbug with OpenSSH v.6.4p1, and Nginx v1.6.0 I'm not sure what auditing software is available in Fedora. Could anyone suggest