I had turned ssh on a while ago to do some remote work. I was just looking over

Question

I had turned ssh on a while ago to do some remote work. I was just looking over some netstat info when I noticed someone had established an ssh session with me D: I turned ssh off immediately and looked up the address.

Netstat said the ssh session was "established". I'm assuming that means they know my password, and I'm going to change it either way, but I want to know if they definitely know my password. I assume my computer's been leaking because there were 68 packets in my Send-Q; I don't know exactly what that is, but I don't like the "Send" bit.

Am I ok if I just wipe my computer and put all my data back on it? I don't do anything important, and I don't connect to any networks that might have sensitive research material or keep much banking or personal information on there. Should I "nuke it from orbit", or is that overkill? If it isn't, how would I go about doing it?

Explanation / Answer

Whether or not you should leave SSH exposed is subject to debate. I'll avoid that.

When you attempt to login to an SSH server, you complete the handshake prior to entering credentials. This means that even without a username or password, an SSH connection can show up as established. If someone was trying to brute force you, you would see some connections as being established.

You should check your server log files. If they have root access, it's easy to hide any wrong doing, so this is not a guarantee.

I would start with your lastlog to see your most recent successful logins. I would then check for failed SSH login attempts, and see if there is any relation to that IP

grep sshd.*Failed /var/log/auth.log | less

There is more you can and should be doing if you feel like you have been compromised. I am not going to cover everything, but wanted to suggest that there is the possibility that you were not compromised based solely on the data you have provided.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.