Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My laptop seems to be acting rather weird - saying that another person is logged in when I try to shut it down (or maybe it likes being turned on).

So how do I know whether my Debian laptop is being hacked or not?

Are there some kind of general guidelines for checking?

share|improve this question
2  
unplug the network cable. if you still get the same message, then it's a problem with the comp, not a hacker – Nate Koppenhaver Aug 8 '11 at 17:18
    
you probably had logged in as a root in the terminal and closed the terminal window without logging out – Baha Aug 8 '11 at 17:20
    
So what does it really do? Can you be a bit more specific (e.g. what does it say exactly)? – slhck Aug 8 '11 at 19:45

Inspect your auth.log:

sudo less /var/log/auth.log
share|improve this answer

You can run w and who commands on the command line to see what is being run and who is connected to your machine. Additionally, you can use netstat -a to see active internet connections.

If you find users you don't recognized connecting to/from unknown addresses/sites then you may want to investigate further.

share|improve this answer

well, it seems that I was a bit paranoid :)

I also found chkrootkit and its howto at: http://www.howtoforge.com/scan_linux_for_rootkits

anyway, thanks for all these answers!

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .