Compromised SSH keys - Linux

Trevor Chandler

Well-known member

Jul 4, 2020

678

624

24,081

Jan 15, 2025

#1

• Jan 15, 2025

• Add bookmark
• #1

Hello CINners,

Anyone have any suggestions on the mechanics that can be used to
identify compromised SSH keys?

Thanks CINners

 

• 
• 

Reactions: BrianFord and precious

precious

Well-known member

Apr 22, 2024

894

614

14,006

Jan 15, 2025

#2

• Jan 15, 2025

• Add bookmark
• #2

You can extract timestamps and usernames for SSH logins

 

• 

Reactions: Trevor Chandler

Trevor Chandler

Well-known member

Jul 4, 2020

678

624

24,081

Jan 15, 2025

#3

• Jan 15, 2025

• Add bookmark
• #3

precious said:

You can extract timestamps and usernames for SSH logins

Click to expand...

Okay, I'll chew on this for a while to see if I can digest it.
Thanks precious!!!!

 

BrianFord

Well-known member

Jun 26, 2023

101

211

11,551

Flagler Beach, FL

fordsnotes.com

Jan 15, 2025

#4

• Jan 15, 2025

• Add bookmark
• #4

Trevor Chandler said:

Hello CINners,

Anyone have any suggestions on the mechanics that can be used to
identify compromised SSH keys?

Thanks CINners

Click to expand...

When the SSH login fails you'll see a message in the log file.

 

• 
• 

Reactions: Steve Mallard, precious and Trevor Chandler

Trevor Chandler

Well-known member

Jul 4, 2020

678

624

24,081

Jan 15, 2025

#5

• Jan 15, 2025

• Add bookmark
• #5

BrianFord said:

When the SSH login fails you'll see a message in the log file.

Click to expand...

Thank you Mr. Brian Ford!!!

 

• 
• 

Reactions: BrianFord and precious