Someone unknown accessed my server via ssh, what steps can I follow to learn more?

Question

First I will admit this machine isn't particularly well secured. It has an ssh port open to the internet, it accepts password login, it's OS and packages are not particularly up to date. I know many steps I can take to secure it and I will do so. However I am curious how I can learn more about this suspected infiltration. Below I list some facts in the order I discovered them:

• I noticed on 2022/02/13 that there were files on my machine I didn't put there.
• Physically the machine hasn't been touched -- I have verified this to my satisfaction.
• The files have modified timestamps from 2022/02/11
• Running journalctl -u ssh reveals some activity on that date that I wasn't responsible for. The c user is my account, but the login via publickey for this user I did not preform -- I have only logged in via password recently and definitely not on 2022/02/11. The referenced tpggq account I know nothing about:

Feb 11 02:16:53 my-computer sshd[24777]: Accepted publickey for c from 62.171.145.175 port 53196 ssh2: RSA SHA256:XAQ5B4s3EirJBS8sN0dWN6c3FJC/KtJpqtvXxXirVxI
Feb 11 02:16:53 my-computer sshd[24777]: pam_unix(sshd:session): session opened for user c by (uid=0)
Feb 11 05:06:55 my-computer sshd[29821]: Protocol major versions differ for 139.144.52.241: SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.10 vs. SSH-1.5-NmapNSE_1.0
Feb 11 05:06:55 my-computer sshd[29828]: fatal: Unable to negotiate with 139.144.52.241 port 46254: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth]
Feb 11 05:06:56 my-computer sshd[29831]: Invalid user tpggq from 139.144.52.241
Feb 11 05:06:56 my-computer sshd[29831]: input_userauth_request: invalid user tpggq [preauth]
Feb 11 05:06:56 my-computer sshd[29831]: Connection closed by 139.144.52.241 port 46268 [preauth]
Feb 11 05:06:56 my-computer sshd[29833]: Connection closed by 139.144.52.241 port 46280 [preauth]

Some more details on the machine:

> uname -a
Linux my-computer 4.4.0-62-generic #83-Ubuntu SMP Wed Jan 18 14:10:15 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

Meta question: Currently I am thinking that a good answer to this would a guide (or links to guides) which give a list of logs to check/commands to run to learn more about what happened during this login. My preference would be a flow chart that I can follow. If someone can help be to adjust this expectation to something more reasonable that would be appreciated. I desire for this question to be answerable and useful to others who are in a similar situation in the future.

Answer 1

I don't see a successful login event. I don't see anything to worry about. Servers facing the internet see hundreds of attempts daily to guess an SSH login/password.

To feel safer:

• Use knockd or something similar (e.g. iptables nftables)
• Make sure your system has no users with weak passwords
• Disable password authentication completely and allow to login only using public key authentication