1

Recently one of my servers has been hacked and it seems they got SSH access (logs are removed, ransom readme files created etc..). The account has a ssh certificate authentication (incl. passphrase for the private key) and I wonder if:

  1. there's any real chance for an attacker to brute force certificate based accounts via ssh?
  2. or the greater chance is, that they even got a trojan on my local computer and got the key file incl. the passphrase?
Improve this question
4
  • Can you clarify 2, do you use a password vault and you worry they stole the file and passphrase?
    – Silver
    Apr 26, 2017 at 6:57
  • No, I dont use password vault, I always type in the password via keyboard whenever I need to unlock the private key.
    – Techradar
    Apr 26, 2017 at 7:21
  • Are you sure root login is disabled and password authentication is disabled in your sshd_config?
    – gtux
    Apr 26, 2017 at 8:03
  • Good point - both PasswordAuthentication & PermitRootLogin are set to yes in SSHD config. But when I try to directly ssh via ssh root@<ip> I get the error Permission denied (publickey).. That should work then, right?
    – Techradar
    Apr 26, 2017 at 12:56

1 Answer 1

Reset to default
2

Brute forcing the certificate is very unlikely. More likely are:

  • Virus/trojan extracting the certificate from one of your systems
  • Vulnerability in SSH server (advanced attacker and/or outdated software)
  • Another entry point besides SSH. Check open ports with nmap
Improve this answer
2
  • Sorry, edited my post, it wasnt clear that I use certificates authentication inkl. a private key passphrase (thats what I mean with "key-pair"). So I am not using a password, just a passphrase to unlock the private key to authenticate against the server.
    – Techradar
    Apr 26, 2017 at 7:20
  • Ah, I will update my answer.
    – Silver
    Apr 26, 2017 at 8:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.