0

I accidentally shared my SSH private and public keys with others. I changed keys within 2 minutes of sharing the private key. I've since added a password to access my private key as well as deleted the old private key and created a new one with ssh-keygen. I don't feel this is enough though.

Since I expose ssh to the Internet, but the user does not have root privileges, should I also format my hard drive and reinstall the operating system, and perhaps obtain new ISP/router/modem??

Improve this question
14
  • ... ok, so why are you asking about formating, re-installing, and the router?
    – schroeder ♦
    Feb 26, 2020 at 23:15
  • 1
    I'm asking if I've done enough to remedy the issue.
    – user227946
    Feb 26, 2020 at 23:15
  • why would you need a new ISP?
    – schroeder ♦
    Feb 26, 2020 at 23:15
  • private key was public for About 2 minutes. The public key was exposed for around 24 hours. But many people may have received an email with the private key as well.
    – user227946
    Feb 26, 2020 at 23:16
  • 1
    no - we can't really help you understand the various connections in and out of your system. A simple reboot of ssh or a reboot of your machine would cut off all connections. In general, I think you are being more paranoid than the situation warrants.
    – schroeder ♦
    Feb 26, 2020 at 23:44

2 Answers 2

Reset to default
3

Simple solution would be to discontinue the use of the existing key pair, generate a new Public / Private key pair and deploy them in place of the old ones.

Improve this answer
1
  • The OP said this was already done
    – schroeder ♦
    Feb 27, 2020 at 9:33
2

1.) Revoke all rights for the key

Revoke all rights associated with this private key. This means, deleting it as trusted key from GitHub, your .ssh/authorized_keys file, etc.. You will have to know where and how you used this private key.

2.) Terminate existing connections

For example, for SSH it is enough to reboot the machine. For GitHub, you may need to contact their support to see if someone else may have further compromised your account.

For other services, you need to figure this out on a case-by-case basis.

3.) Verify the attacker no longer has access

This means making sure that the attacker did not persist themselves further in your system. This could, for example, mean that they added new users, enabled SSH login for root with a pre-set password, installed other backdoors, etc.

Checking your log files will greatly help you, although you cannot be sure if an attacker has modified them.

My personal opinion is that it depends on what "sharing it with others" means. Did you just expose your private key, but didn't directly link to it in some way? If so, then two minutes is probably too short for anyone to notice.

Did you actively post your private key somewhere, such as Facebook? Then you might have a bit more of a reason to worry.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .