Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My laptop seems to be acting rather weird - saying that another person is logged in when I try to shut it down (or maybe it likes being turned on).

So how do I know whether my Debian laptop is being hacked or not?

Are there some kind of general guidelines for checking?

share|improve this question
2  
unplug the network cable. if you still get the same message, then it's a problem with the comp, not a hacker –  Nate Koppenhaver Aug 8 '11 at 17:18
    
you probably had logged in as a root in the terminal and closed the terminal window without logging out –  Baha Aug 8 '11 at 17:20
    
So what does it really do? Can you be a bit more specific (e.g. what does it say exactly)? –  slhck Aug 8 '11 at 19:45
add comment

3 Answers

Inspect your auth.log:

sudo less /var/log/auth.log
share|improve this answer
add comment

well, it seems that I was a bit paranoid :)

I also found chkrootkit and its howto at: http://www.howtoforge.com/scan_linux_for_rootkits

anyway, thanks for all these answers!

share|improve this answer
add comment

You can run w and who commands on the command line to see what is being run and who is connected to your machine. Additionally, you can use netstat -a to see active internet connections.

If you find users you don't recognized connecting to/from unknown addresses/sites then you may want to investigate further.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.