Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My laptop seems to be acting rather weird - saying that another person is logged in when I try to shut it down (or maybe it likes being turned on).

So how do I know whether my Debian laptop is being hacked or not?

Are there some kind of general guidelines for checking?

share|improve this question
unplug the network cable. if you still get the same message, then it's a problem with the comp, not a hacker – Nate Koppenhaver Aug 8 '11 at 17:18
you probably had logged in as a root in the terminal and closed the terminal window without logging out – Baha Aug 8 '11 at 17:20
So what does it really do? Can you be a bit more specific (e.g. what does it say exactly)? – slhck Aug 8 '11 at 19:45

Inspect your auth.log:

sudo less /var/log/auth.log
share|improve this answer

You can run w and who commands on the command line to see what is being run and who is connected to your machine. Additionally, you can use netstat -a to see active internet connections.

If you find users you don't recognized connecting to/from unknown addresses/sites then you may want to investigate further.

share|improve this answer

well, it seems that I was a bit paranoid :)

I also found chkrootkit and its howto at:

anyway, thanks for all these answers!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.