How to investigate OVH's claim that my VPS might be compromised
So, a few hours ago, OVH sent me an email saying my VPS is demonstrating abusive behaviour. OVH sent me some logs alleging my VPS's IP tried to connect to some other machine. Here are the logs :
Jul 1 01:25:59 bryant sshd[2790733]: Failed password for root from [My VPS IPv4] port 39396 ssh2
Jul 1 01:33:32 bryant sshd[2793661]: Failed password for root from [My VPS IPv4] port 38460 ssh2
Jul 1 01:35:17 bryant sshd[2795219]: Failed password for root from [My VPS IPv4] port 34122 ssh2
Jul 1 01:36:59 bryant sshd[2795619]: Failed password for root from [My VPS IPv4] port 54848 ssh2
Jul 1 01:38:42 bryant sshd[2797464]: Failed password for root from [My VPS IPv4] port 48058 ssh2
Jul 1 02:44:19 rachael sshd[3638742]: Invalid user git from [My VPS IPv4]
Jul 1 02:44:22 rachael sshd[3638742]: Failed password for invalid user git from [My VPS IPv4] port 47444 ssh2
Jul 1 02:52:03 rachael sshd[3642915]: Failed password for root from [My VPS IPv4] port 33174 ssh2
Jul 1 02:53:36 rachael sshd[3643220]: Invalid user ubuntu from [My VPS IPv4]
Jul 1 02:53:37 rachael sshd[3643220]: Failed password for invalid user ubuntu from [My VPS IPv4] port 51288 ssh2
Jul 1 12:53:36 batty sshd[319842]: Failed password for root from [My VPS IPv4] port 35854 ssh2
Jul 1 13:06:12 batty sshd[326640]: Failed password for root from [My VPS IPv4] port 40968 ssh2
Jul 1 13:07:47 batty sshd[327162]: Failed password for root from [My VPS IPv4] port 57886 ssh2
Jul 1 13:09:19 batty sshd[327692]: Failed password for root from [My VPS IPv4] port 44030 ssh2
Jul 1 13:10:48 batty sshd[328850]: Failed password for root from [My VPS IPv4] port 53374 ssh2
I have no clue where to begin the search (what logs ? what to look for?) to check this really happened on/from my VPS and what to do about it. If anybody has any insight, I'll gladly take it.
u/zer0isnotnull — 5 days ago