Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a linux VPS and I received a complaint that my server was scanning on port 22 some other network. How do I find out if it was compromised or not?

share|improve this question

3 Answers 3

I answered a question earlier today that has recommendations in this area:

http://serverfault.com/questions/120839/linux-backdoors-i-should-be-wary-of

If you suspect that it may have been one of your users and your default shell is bash, you can grep through the .bash_history. For example:

grep nmap /home/*/.bash_history

It's notable that your users can modify the history unless you've introduced methods to make it more difficult.

share|improve this answer

Well, if you WERE scanning.... what is the doubt?

share|improve this answer
    
I'm not scanning dude. That is the problem lol –  Jene Hackman Mar 9 '10 at 22:15
    
How you know? Take a measurement from outside (firewall, router in front, wahtever). –  TomTom Mar 10 '10 at 6:13

You have to think outside the box. As in, you can't really trust what's inside the box.

For instance, get your provider to monitor outgoing traffic. Traffic you can't explain => assume the server has been compromised.

Get an image of the hard drive (extracted using trusted binaries) and run forensics.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.