This question already has an answer here:

I run a Debian Stretch box. I had mistakenly forgot to delete a guest account I opened for a, well, guest of mine, and I suspect my system may have been compromised using that account. I'm not entirely sure, but I saw a few processes belonging to guest taking up CPU time - some sshd's and a /sbin/syslogd instance (which kind of scared me).

So, I killed the processes and removed the user, good for me. But - what would be a good idea to also do? Something specific to look for in the logs? Reinstallation of packages? Nuke the thing from orbit?

marked as duplicate by Ƭᴇcʜιᴇ007, Jakuje, DavidPostill, MariusMatutiae linux Jul 28 '16 at 12:38

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


It depends on desired level of trust to system.

From optimistic side:

If everything happens really as You say. I can't say this system compromised. More correct it unwanted access. As long intruder can't get root or other privileged user access.

At minimum You do everything right.

pessimistic side:

If You suspect and afraid that intruder make permission escalation (by exploiting some vulnerability) and install some kind of rootkit.

Any audit under control of potentially compromised system has very small trust. It just hope for "bugs" in rootkit that prevent it from perfect hiding itself.

Is better to complete reinstall system or make audit (by compare with backup or verify or reinstall packages by package manager) when you booted from trusted system on external bootable media or connecting drive to trusted system.

In this way, I hope, You get more detailed advices.

paranoid side

If root is compromised then even BIOS or integrated management like IME can be taken in control to install rootkit again in fresh system.

Not the answer you're looking for? Browse other questions tagged or ask your own question.