1

I just got the warning message from hosting provider that my server make outcoming traffic 1.5G to provide DDOS attack on someone host, and they disabled my VPS temporarily.

When I search through auth.log I saw someone logged in with private key, and the only one key on the server is mine. I can't believe someone could stole private key from my computer. Can the hacker somehow logged in without the private key?

4
  • 1
    This depends on your server configuration. Have you disabled login with username and password?
    – BadSkillz
    Apr 11, 2016 at 9:32
  • No, it is allowed. For now I disabled RSA authentication so hacker can't login anymore. According to logs he logged in using the key, but not the password. Password is 20 length long, very hard.
    – James May
    Apr 11, 2016 at 9:36
  • 2
    Are you sure that the attacker did not tamper with your logs?
    – Yuriko
    Apr 11, 2016 at 10:02
  • 1
    If it were me, I'd consider reverting to passwords a temporary option until I had updated my key pairs, checked the patches and reviewed the security on where the private key is stored.
    – symcbean
    Apr 11, 2016 at 10:05

1 Answer 1

3

I suspect your key are affected by the issue of weak keys, that was generated using the process ID as seed: https://github.com/g0tmi1k/debian-ssh

Note that this are only dependent on which machine you generated your keys on, NOT the SSH'ed machine.

There is then a possibility that the attacker predicted your key. Thats why I suggest regenerating the keys, using a debian version where this issue has been fixed, and then replacing the keys in your VPS.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.