Due to a stupid oversight on my side, I have opened my personal computer running Linux to the public internet for a little over 48 hours. Unfortunately, I realized my mistake too late and found several successful brute forced login attempts in my system log, from IP addresses from all over the globe. Furthermore, the user they used to log in had root access. The sessions only lasted a second each, so I assume these were automated accesses from bots scanning the internet for open SSH servers.
Here is an example entry from my system log:
Jul 01 16:17:51 hostname sshd[21370]: Accepted password for user from 146.0.XXX.XXX port 50424 ssh2
Jul 01 16:17:51 hostname sshd[21370]: pam_unix(sshd:session): session opened for user user by (uid=0)
Jul 01 16:17:51 hostname sshd[21370]: pam_unix(sshd:session): session closed for user user
Now please, do not ridicule me - I have realized the gravity of my mistake and I consider my computer fully compromised. I will setup a fresh install, carefully recover data from backups prior to the infiltration and change all my passwords and keys.
What I would like to know is how to assess the damage that was caused. Can I possibly look into the commands run by those bots and the data accessed by them? Unfortunately, .bash_history
does not contain any new entries for my user or the root user. Since the sessions only lasted a second each, I hope that they could not have downloaded much private data from my hard drive?