What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious ...
I have a linux VPS and I received a complaint that my server was scanning on port 22 some other network. How do I find out if it was compromised or not?
I'm new to the server management realm and I'm sure my server is very insecure. I've gone through the WHM CPanel security check but I'm sure to the real gurus, that check is stupid and nowhere near ...