<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>
<div>
<div>It's likely that if he left that key in there with a valid e-mail address then whoever compromised the server wasn't trying to be discrete. I would check my auth logs to see when/if someone was logging in from somewhere suspect. Next if the server was
compromised, it's done, you can never trust it again, no amount of clean up or post-mortem investigation can ever give reasonable confidence that there's no back door on it. Move the services and data and make a new server/clean install, then look very carefully
at what attack vector was exploited and close it (like if it was brute force you should have ssh for root turned off, more restrictive firewall rules and ssh guard).</div>
<div><br>
</div>
<div>Having a server compromised can be a huge headache, good luck.</div>
<div>
<div>
<div>-- </div>
<div>
<div style="font-family: Consolas; font-size: medium; ">Paul Mooring</div>
<div style="font-family: Consolas; font-size: medium; ">Systems Engineer and Customer Advocate</div>
<div style="font-family: Consolas; font-size: medium; "><br>
</div>
<div style="font-family: Consolas; font-size: medium; ">www.opscode.com</div>
</div>
</div>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Vimal Shah <<a href="mailto:vimals@sokikom.com">vimals@sokikom.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Main PLUG discussion list <<a href="mailto:plug-discuss@lists.phxlinux.org">plug-discuss@lists.phxlinux.org</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, March 7, 2013 4:49 PM<br>
<span style="font-weight:bold">To: </span>Main PLUG discussion list <<a href="mailto:plug-discuss@lists.phxlinux.org">plug-discuss@lists.phxlinux.org</a>><br>
<span style="font-weight:bold">Subject: </span>server compromised?<br>
</div>
<div><br>
</div>
<div>
<div>Hello all,
<div><br>
</div>
<div>While randomly looking into the .ssh/authorized_keys file, I noticed a line that shouldn't have been there. This was concluded based on the last portion of the line. This portion was in the form of
<i><a href="mailto:user@domain.com" target="_blank">user@domain.com</a></i>, where the domain was one of a likely competitor. Does this automatically mean that this server has been compromised? The line has been removed.</div>
<div><br>
</div>
<div>Thanking everyone in advance.</div>
<div>
<div><br>
</div>
-- <br>
<font size="3">
<div style="border-collapse:collapse;font-family:arial,sans-serif;font-size:13px">
<font face="arial,helvetica,sans-serif">Vimal <br>
</font></div>
</font>
<div></div>
</div>
</div>
</div>
</span>
</body>
</html>