0

I had turned ssh on a while ago to do some remote work. I was just looking over some netstat info when I noticed someone had established an ssh session with me D: I turned ssh off immediately and looked up the address.

Netstat said the ssh session was "established". I'm assuming that means they know my password, and I'm going to change it either way, but I want to know if they definitely know my password. I assume my computer's been leaking because there were 68 packets in my Send-Q; I don't know exactly what that is, but I don't like the "Send" bit.

Am I ok if I just wipe my computer and put all my data back on it? I don't do anything important, and I don't connect to any networks that might have sensitive research material or keep much banking or personal information on there. Should I "nuke it from orbit", or is that overkill? If it isn't, how would I go about doing it?

Improve this question

1 Answer 1

Reset to default
1

Whether or not you should leave SSH exposed is subject to debate. I'll avoid that.

When you attempt to login to an SSH server, you complete the handshake prior to entering credentials. This means that even without a username or password, an SSH connection can show up as established. If someone was trying to brute force you, you would see some connections as being established.

You should check your server log files. If they have root access, it's easy to hide any wrong doing, so this is not a guarantee.

I would start with your lastlog to see your most recent successful logins. I would then check for failed SSH login attempts, and see if there is any relation to that IP

grep sshd.\*Failed /var/log/auth.log | less

There is more you can and should be doing if you feel like you have been compromised. I am not going to cover everything, but wanted to suggest that there is the possibility that you were not compromised based solely on the data you have provided.

Improve this answer
6
  • Ok, that's good to know. My password is pretty strong/random, so I think it's less likely then I thought. I'll look over how to deal with a possible compromise (I assume I can find resources for that on here). I'm on mavericks, so I don't have an auth.log. Apparently its in "asl", which I was told I can access through the syslog command. I'll probably find it on my own, but you wouldn't know how to access the auth attempts on a mac, would you?
    – Loktopus
    May 23, 2014 at 2:29
  • /var/log/secure.log ?
    – David Houde
    May 23, 2014 at 2:30
  • Yep, that's it, thanks. Pretty sure they didn't get in. I'm showing failed authentication attempts from that ip right up until I turned off ssh.
    – Loktopus
    May 23, 2014 at 2:36
  • Good, I'm glad you didnt nuke it from orbit :)
    – David Houde
    May 23, 2014 at 2:48
  • You really should look into using public key authentication for SSH: not only is it easy to setup but it also makes it waaaay harder for someone to gain access.
    – Stephane
    May 23, 2014 at 12:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .