This question already has an answer here:
- How do I deal with a compromised server? 13 answers
This morning I found myself unable to log into the root account on one of my (CentOS 6) servers. I booted into single user mode and reset the root password. Everything seems to be working normally now.
I have a number of monitoring metrics that watch behavior on this server and have seen no evidence of nefarious activity. However, I am not sure I can trust the security of this server without doing a full OS reinstall.
- What steps can I take to diagnose the cause of this?
- In theory someone may have had root access to my machine. Is there any way I can rule this possibility out?