Ask HN: Anonymous person sent proof of SSH access to our production server

Given that no threat or demand was made, this sounds like they were just notifying you of a vulnerability.

Does your company / product have an official responsible disclosure policy?

Give the person a small reward for pointing out the vulnerability and offer another small reward for suggesting how to fix it.

Re-install the server

On new re-installed server:

1. Change SSH service port to non-default one. 2. Do not allow root user to remotely connect (change sshd config) 3. Create new user which you will be using for administration to login as root. 4. If possible restrict which IP addresses are allowed to connect via SSH using firewall.

> where would be a good place to source security experts?

There's no universal good answer for this.

I spend a lot of time on ##crypto (irc.freenode.net), and a lot of smart folks hang out there. Some are very well connected to other security experts in their own isolated communities.

However, there are undoubtedly silos of security expertise that remain untapped if you rely on just IRC.

You could also find folks who talk about security here on HN and follow their Twitter accounts (if public).

You could try "[development stack] security expert" in a Google search, as a last resort. (My company's currently at the bottom of the first page for PHP, although that's likely only true because of our filter bubble.)

A diverse approach is probably most likely to succeed here.

I would also add to this to block any password authentication and use SSH keys.