If a Key Is Compromised
A compromised key usually means the instances it reached are compromised too, so the checks below apply to every host the key could reach.
Rotation is the first step, and does not wait for a maintenance window. See Rotate SSH Keys for the procedure.
Check what the host trusts¶
Keys you did not add are a common way of keeping access:
Check what has been used¶
The journal records which keys have been used to log in, and from where:
Each line records the fingerprint that was accepted, so you can tell which
sessions were yours and which were not. On older images that still write a text
log, use sudo grep "Accepted publickey" /var/log/auth.log instead.
Check what the daemon allows¶
The daemon may also be accepting passwords:
passwordauthentication should read no. permitrootlogin reads
prohibit-password on the Ubuntu cloud images, which allows root in by key
only, and no is the safer setting unless something genuinely needs root
over SSH.
Then the rest¶
- Rotate the key, following Rotate SSH Keys
- Rotate any application credentials and EC2 credentials that the instance or the person held
- An instance you cannot fully account for is safer rebuilt than cleaned
- Security groups can limit port 22 to the addresses you expect
- Please contact Support if data may have been exposed