1

Recently one of my servers has been hacked and it seems they got SSH access (logs are removed, ransom readme files created etc..). The account has a ssh certificate authentication (incl. passphrase for the private key) and I wonder if:

  1. there's any real chance for an attacker to brute force certificate based accounts via ssh?
  2. or the greater chance is, that they even got a trojan on my local computer and got the key file incl. the passphrase?
Improve this question
4
  • Can you clarify 2, do you use a password vault and you worry they stole the file and passphrase?
    – Silver
    Commented Apr 26, 2017 at 6:57
  • No, I dont use password vault, I always type in the password via keyboard whenever I need to unlock the private key.
    – Techradar
    Commented Apr 26, 2017 at 7:21
  • Are you sure root login is disabled and password authentication is disabled in your sshd_config?
    – gtux
    Commented Apr 26, 2017 at 8:03
  • Good point - both PasswordAuthentication & PermitRootLogin are set to yes in SSHD config. But when I try to directly ssh via ssh root@<ip> I get the error Permission denied (publickey).. That should work then, right?
    – Techradar
    Commented Apr 26, 2017 at 12:56

1 Answer 1

Reset to default
2

Brute forcing the certificate is very unlikely. More likely are:

  • Virus/trojan extracting the certificate from one of your systems
  • Vulnerability in SSH server (advanced attacker and/or outdated software)
  • Another entry point besides SSH. Check open ports with nmap
Improve this answer
2
  • Sorry, edited my post, it wasnt clear that I use certificates authentication inkl. a private key passphrase (thats what I mean with "key-pair"). So I am not using a password, just a passphrase to unlock the private key to authenticate against the server.
    – Techradar
    Commented Apr 26, 2017 at 7:20
  • Ah, I will update my answer.
    – Silver
    Commented Apr 26, 2017 at 8:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .