How to assess damage on compromised SSH server on personal computer

Question

Due to a stupid oversight on my side, I have opened my personal computer running Linux to the public internet for a little over 48 hours. Unfortunately, I realized my mistake too late and found several successful brute forced login attempts in my system log, from IP addresses from all over the globe. Furthermore, the user they used to log in had root access. The sessions only lasted a second each, so I assume these were automated accesses from bots scanning the internet for open SSH servers.

Here is an example entry from my system log:

Jul 01 16:17:51 hostname sshd[21370]: Accepted password for user from 146.0.XXX.XXX port 50424 ssh2
Jul 01 16:17:51 hostname sshd[21370]: pam_unix(sshd:session): session opened for user user by (uid=0)
Jul 01 16:17:51 hostname sshd[21370]: pam_unix(sshd:session): session closed for user user

Now please, do not ridicule me - I have realized the gravity of my mistake and I consider my computer fully compromised. I will setup a fresh install, carefully recover data from backups prior to the infiltration and change all my passwords and keys.

What I would like to know is how to assess the damage that was caused. Can I possibly look into the commands run by those bots and the data accessed by them? Unfortunately, .bash_history does not contain any new entries for my user or the root user. Since the sessions only lasted a second each, I hope that they could not have downloaded much private data from my hard drive?

Answer 1

The fact that ssh connection was open for a short time does not tell anything about the damage. May be some malicious daemon was installed and your information was accessed or downloaded later on, without ssh or scp or similar tools.

.bash_history may have been manipulated. That's why no new entries does not mean no command was executed.

You can exactly assess damage only if you have saved your full network traffic since that time and if you can decrypt it. Otherwise we can only speak about probability and risk.