1

Recently one of my servers has been hacked and it seems they got SSH access (logs are removed, ransom readme files created etc..). The account has a ssh certificate authentication (incl. passphrase for the private key) and I wonder if:

  1. there's any real chance for an attacker to brute force certificate based accounts via ssh?
  2. or the greater chance is, that they even got a trojan on my local computer and got the key file incl. the passphrase?
  • Can you clarify 2, do you use a password vault and you worry they stole the file and passphrase? – Silver Apr 26 '17 at 6:57
  • No, I dont use password vault, I always type in the password via keyboard whenever I need to unlock the private key. – Techradar Apr 26 '17 at 7:21
  • Are you sure root login is disabled and password authentication is disabled in your sshd_config? – gtux Apr 26 '17 at 8:03
  • Good point - both PasswordAuthentication & PermitRootLogin are set to yes in SSHD config. But when I try to directly ssh via ssh root@<ip> I get the error Permission denied (publickey).. That should work then, right? – Techradar Apr 26 '17 at 12:56
2

Brute forcing the certificate is very unlikely. More likely are:

  • Virus/trojan extracting the certificate from one of your systems
  • Vulnerability in SSH server (advanced attacker and/or outdated software)
  • Another entry point besides SSH. Check open ports with nmap
  • Sorry, edited my post, it wasnt clear that I use certificates authentication inkl. a private key passphrase (thats what I mean with "key-pair"). So I am not using a password, just a passphrase to unlock the private key to authenticate against the server. – Techradar Apr 26 '17 at 7:20
  • Ah, I will update my answer. – Silver Apr 26 '17 at 8:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.