So I setup a linux server and forgot to disable clear text ssh password or install denyhosts or enable any kind of password policy. Usually I have deny hosts and it works well. As a result of missing this vital step (yes I should automate the process) a user with a weak password has been hacked. Now on the assumption that the general permissions are good what can I do to work out what they did and remove it?
By the way I am a programmer by nature not a system admin so please be kind!