Recently one of my servers has been hacked and it seems they got SSH access (logs are removed, ransom readme files created etc..). The account has a ssh certificate authentication (incl. passphrase for the private key) and I wonder if:
- there's any real chance for an attacker to brute force certificate based accounts via ssh?
- or the greater chance is, that they even got a trojan on my local computer and got the key file incl. the passphrase?
ssh root@<ip>I get the error
Permission denied (publickey).. That should work then, right?