So I am in the middle of touching up my Linux server skills and I was wondering what steps linux server admins take to verify no one has been snooping around their servers, either through a login that has been hacked or one that was created. I am aware of commands like (last) and (finger < username >) to do some general checking around, but I was hoping someone could get a little more in depth about their process and/or tools of choice.
If it helps, consider this scenario: I am a lone sys admin for a small company and recently went on vacation for 2 weeks. I arrive back in the office on Monday wanting to see if any strange activity has happened (assuming there are no clearly visible signs), since the company I work for did not want to pay anyone to watch things while I was gone. Basically I want to make sure that someone does not have complete control of the server and is just waiting to use it at the right moment.
*Now obviously a good hacker knows how to hide their trail, but lets assume any potential hackers are lazy and somewhat sloppy.
This question was great for once an attacker is recognized: http://serverfault.com/questions/96112/how-to-find-an-unauthorized-persons-entry-point-to-a-server
I am more curious about steps to find these potential unauthorized users.
Any thoughts or resources appreciated.
