Step one: take the server offline, shut it down, and make a clone of the hard drive. When doing your forensic work, use only this clone drive, leaving the original untouched.
You should be able to throw the clone drive into another system, mount it, and start poking around to see what the user did. The first thing I'd check is the user's ~/.bash_history
, if there is one. Most smart hackers will delete this file when they're done with their work, but there's a chance it may still be around. If that doesn't work, then all you really have to go by are log messages in /var/log. You may try running rkhunter
over the system, but IMO, it's not worth it, as you already know that this system is compromised. Depending on how savvy this user was, you may never know what they actually did.
If I were you, I'd do a full re-install of the system and restore from a known-good backup. That's the only way you'll be able to be certain the system isn't compromised. Additionally, when you bring the new system up, do yourself a favor, and turn off PasswordAuthentication
in your /etc/ssh/sshd_config
file and use key auth instead. By doing this, you'll be much safer from this sort of malicious activity.