POWOKEClient areaPreserve a second way in
Confirm console or provider recovery access and record the OS and management port. Keep the existing SSH session open while testing changes in a second terminal. Do not change authentication, firewall rules and ports simultaneously.
Prove key authentication works
Protect the private key locally and install its public key in the intended account authorized_keys file. Check ownership and permissions. Only consider disabling passwords after a second key-authenticated session succeeds. Validate sshd configuration before reloading it.
Expose only required services
Document the allowed sources for SSH, HTTP, HTTPS and application ports. Restrict database and administration interfaces to trusted networks where possible. Check both cloud rules and the host firewall. Distinguish a missing listener from filtering and upstream reachability failures.
Collect evidence before recovery
Save timestamps, source addresses, authentication logs and process observations. For suspected compromise, isolate the host, preserve evidence, rotate credentials and rebuild from trusted media. Killing a process is not proof of eradication. Attacks that exceed the access link require network-side assistance.