Ask HN: Anonymous person sent proof of SSH access to our production server
In addition to the wonderful technical advice already here for how to deal with the server, there is the question for how to deal with the anonymous person.  If the proof contained the method of exploit I suggest something along the lines of:"Thank you for bringing this problem to our attention!  We are taking steps to resolve the problem now, but would like to reward you for your work.  If you let us know how you would like to receive if, we would be happy to donate $X to your efforts."Where $X is something you think you can easily part with, $100, $250, $500, $1000?  This both primes the sender to be more generous, if they were on the fence as to whether to do something nefarious, and establishes some small trail to them (depending on method) in case of major problems with them later.If the proof was not included in the email, I think it's much more likely you just received the opening email in a blackmail campaign.  It's highly unlikely that server is even the entry point in that case, so cleaning it will not resolve the problem.  It's just the sacrificial lamb for them to prove they've got leverage and let you stew, and they can contact you again after you think you've cleaned out the problem to let you know they still have access, and the only way to be rid of them is the pay them.