OpenSSH: hacked before set up?

Question

Today I tried setting up OpenSSH on my computer with the hope of being able to connect to it from a different computer at work. This was my first time attempting to use open-ssh.

I did the following steps:

• sudo apt-get install openssh-server
• modified /etc/ssh/sshd_config
  • changed port from 22 to a number above 2000
  • changed PermitRootLogin to no
  • changed PasswordAuthentication to no
• did /etc/init.d/ssh restart

I basically tried to follow all of the security rules that were established in online documentation. I then fooled around a bit trying to set up port forwarding on the router.

I assumed that since I had not generated any keys or set up any passwords explicitly, nobody could access the server that I suppose was actually running.

My question, basically, is that I've now become concerned by a few factors: my Internet seems slower, and I've had a few applications crash unexpectedly. It seems like all of a sudden my computer has become less dependable and my automatic thought has been to check my assumption that an open-ssh server is not accessible if its keys have not been generated and no password has been set.

My question then, is what is the state of the open-ssh server when it is restarted for the first time? Is there any way that it can be accessed by malicious people on the outside? Since I didn't get to the point of setting passwords or certificates up (because I got scared), at what point does the open-ssh server become a liabilty (i.e. hackable)?

I sort of can't imagine that the server is instantly accessible with some sort of default password: that would be very easy to take advantage of, right? At the same time, though, I'm worried because this is all very new to me.

Some things I see in /var/log/auth.log that worried me:

• messages from polkitd(authority=local) saying something about an Unregistered Authentication Agent
• repeated attempts to access /lib/security/pam_kwallet.so
• message that /tmp/.X11-unix/X0 has been linked to /run/user/112/X11-display (who is user 112?)

I have looked each of these up and it seems they can be explained away but at the same time, a computer without this attempt at setting up openssh has decidely fewer weird messages like this.

hoping someone can comfort me.

Answer 1

I highly doubt think you were hacked. Maybe some automated bot TRIED doing something, but I doubt that even happened..

If you disabled Password Auth and did not have a public key set up, there is very very little chance of anything even possibly happening.

In answer to your auth.log queries:

1. That is just PAM complaining about something. Usually just a programming error or a bad dependency. Missing SSH certs maybe? (Nothing to worry about)
2. Pretty much the same thing as #1. I assume someone (sshd) was trying to find certificates and didn't find them. Certs are generally stored in things called "wallets". (Nothing to worry about)
3. User 112 is the LightDM user. It is completely normal for it to be talking to the Xserver. (Nothing to worry about)

Regarding instability and network speed, you just enabled a server. It will definitely be slower. Even if nothing is happening. The increase in program crashing is also probably related. More resources are being used on your computer now. Maybe there are a few config issues.

---

Also, I've dealt with hackers. If they got in looking for sensitive documents and didn't find them, they'll often troll. They'll delete random files. They'll wipe hard drives. They'll leave your system a broken mess. I think you're safe.