Recover and Re-secure SSH on Linux

Phase 1: Regain Access and Initial Assessment

First, we need to get you back into your system and determine the extent of the compromise without tipping off the attacker.

Disconnect the compromised machine from the internet immediately to prevent further attacker activity.
Access your system through a secure, alternative method, such as a local console or a previously configured out-of-band management tool.
Change the passwords for all user accounts, especially root and any accounts with sudo privileges, using strong, unique passwords.

Important

Do not delete any user accounts yet, as this may alert the attacker to your discovery.

Now that you have control, it's time to find and eradicate any malicious software or backdoors the attacker might have installed.

Review system logs (e.g., /var/log/auth.log, /var/log/syslog) for unusual activity, unauthorised logins, or failed login attempts.
Check for unknown or suspicious processes using ps aux and investigate any that seem out of place. Terminate malicious processes with kill -9 [PID].
Scan your system for rootkits with tools like Rootkit Hunter (rkhunter) or Chkrootkit (chkrootkit).
Inspect cron jobs (crontab -l) for any scheduled tasks that you didn't create.
Examine system startup scripts and services that launch at boot (e.g., systemctl list-unit-files --state=enabled) for anything suspicious.

Good to know

Look for files or directories with unusual names, locations, or modification times.

With the immediate threats contained, we can now focus on cleaning up the damage and making your SSH service secure again.

Remove any unauthorised SSH keys from ~/.ssh/authorized_keys for all users.
Review and harden your SSH configuration file (/etc/ssh/sshd_config):
- Disable password authentication (PasswordAuthentication no).
- Disallow root login (PermitRootLogin no).
- Change the default SSH port (Port [NEW_PORT_NUMBER]).
- Limit users who can connect via SSH (AllowUsers username).
Restart the SSH service (e.g., sudo systemctl restart sshd) to apply changes.
Consider setting up a firewall (e.g., ufw or firewalld) to only allow SSH connections from trusted IP addresses.

Tip

Always back up your sshd_config file before making changes.

A secure system is an ongoing effort. These steps will help you maintain the integrity of your SSH and overall system security.

Regularly update your operating system and all installed software to patch known vulnerabilities.
Implement two-factor authentication (2FA) for SSH access for an extra layer of security.
Regularly review system logs for any unusual activity.
Use intrusion detection systems (IDS) such as Fail2Ban to automatically block suspicious IP addresses.
Regularly back up your important data to an offsite location.

Good to know

Consider migrating to SSH keys instead of passwords for authentication, as they are generally more secure.

Tags:

Was this guide helpful?

Know someone who needs this? Send them the guide.

Written by

Founder, CyberSecurityGuides

Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.

Reviewed by CSG Security Engineers