I have a linux VPS and I received a complaint that my server was scanning on port 22 some other network. How do I find out if it was compromised or not?
I answered a question earlier today that has recommendations in this area:
If you suspect that it may have been one of your users and your default shell is bash, you can grep through the
It's notable that your users can modify the history unless you've introduced methods to make it more difficult.
You have to think outside the box. As in, you can't really trust what's inside the box.
For instance, get your provider to monitor outgoing traffic. Traffic you can't explain => assume the server has been compromised.
Get an image of the hard drive (extracted using trusted binaries) and run forensics.