I recently read an article about analyzing malicious SSH login attempts. This got me thinking, are the SSH username, password combinations on my Debian box that uncommon? Had I been targeted by a brute force dictionary attack? Let's take a look at /var/log/auth.log.0:
Sep 23 07:42:04 SLUG sshd: Invalid user tyjuan from 220.127.116.11 Sep 23 07:42:09 SLUG sshd: Invalid user tykeedra from 18.104.22.168 Sep 23 07:42:14 SLUG sshd: Invalid user tykeem from 22.214.171.124 Sep 23 07:42:19 SLUG sshd: Invalid user tykeshia from 126.96.36.199 Sep 23 07:42:25 SLUG sshd: Invalid user tyla from 188.8.131.52 Sep 23 07:42:30 SLUG sshd: Invalid user tylan from 184.108.40.206 Sep 23 07:42:35 SLUG sshd: Invalid user tylar from 220.127.116.11 Sep 23 07:42:40 SLUG sshd: Invalid user tyler from 18.104.22.168 Sep 23 07:42:45 SLUG sshd: Invalid user tylerfrank from 22.214.171.124 Sep 23 07:42:50 SLUG sshd: Invalid user tyliah from 126.96.36.199 Sep 23 07:42:55 SLUG sshd: Invalid user tylor from 188.8.131.52
So that doesn't look good. Now that I know I've been targeted by an attack and that some of my username, password combinations are weak, I'd like to know how can I...
- ... determine if my Linux box has been infiltrated?
- ... undo any of the damage left by the perpetrators?
- ... prevent this from happening in the future?
Any advice on undo any of the damage left by the perpetrators?