Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I am in the middle of touching up my Linux server skills and I was wondering what steps linux server admins take to verify no one has been snooping around their servers, either through a login that has been hacked or one that was created. I am aware of commands like (last) and (finger < username >) to do some general checking around, but I was hoping someone could get a little more in depth about their process and/or tools of choice.

If it helps, consider this scenario: I am a lone sys admin for a small company and recently went on vacation for 2 weeks. I arrive back in the office on Monday wanting to see if any strange activity has happened (assuming there are no clearly visible signs), since the company I work for did not want to pay anyone to watch things while I was gone. Basically I want to make sure that someone does not have complete control of the server and is just waiting to use it at the right moment.

*Now obviously a good hacker knows how to hide their trail, but lets assume any potential hackers are lazy and somewhat sloppy.

This question was great for once an attacker is recognized:

I am more curious about steps to find these potential unauthorized users.

Any thoughts or resources appreciated.

share|improve this question
up vote 1 down vote accepted

install and configure aide and have it send its daily reports to an external e-mail address. That way if something changes to the files you ask it to monitor, you will know.

share|improve this answer
I like it. I had something similar before but did not explore its full capability. Appreciate the suggestion! – user48921 Jul 21 '10 at 19:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.