I didn't patch my website right after PSA-2014-003, it run about one week unpatched.

Now, I'm moving my website to a new server, using an old database backup. In my old server, I used an passphrase protected authentication key to login to the server over ssh. The website in question doesn't use SSL (https).

In the chart on http://drupal.geek.nz/blog/your-drupal-website-has-backdoor, is says: "Revoke public keys for any of the server's private keys." I don't really understand what does it means. Does it refers to certificate-authenticated SSL (https://) or does it refers to the authentication keys used to login to the server over ssh? Do I have to generate a new pair of authentication keys for my new server?


1 Answer 1


Short answer

You don't need to replace your SSH-keys if only their public part was stored on the server. And that's usually the case if you've only used it for logging into the server.

Long answer

Since the server may have been compromised all the data on the server might have been copied by any number of attackers. This includes everything used for authentication:

  • private keys (SSH, SSL, GPG, …)
  • passwords, if they were stored in an insecure manner
  • API-keys for other web-services
  • The mysql password

You should replace all of them.

For SSH's public-key authentication you usually copy your public key into the ~/.ssh/authorized_keys file. Your private key remains safely on your computer. Therefore there is no need to replace your ssh-keys. That's the main benefit of asymmetric encryption: Everyone can have your public key without compromising the security.

  • Thanks for your reply, I have my private key only on my computer and I only copied the public key into the server. So I think I'm safe, despite they may have stolen the public key. Time ago, I created an user on the affected server to make automatic backups into another server. This user used ssh keys to copy files into the destination server. So now, the backup destination server may also be affected. What a mess!! Nov 29, 2014 at 18:18
  • In the future you could avoid that by pulling the backups instead of pushing them. Nov 29, 2014 at 18:29
  • Thanks. That's good advice. I will investigate further about it. Nov 29, 2014 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.