I run a Debian Stretch box. I had mistakenly forgot to delete a guest account I opened for a, well, guest of mine, and I suspect my system may have been compromised using that account. I'm not entirely sure, but I saw a few processes belonging to guest taking up CPU time - some sshd
's and a /sbin/syslogd
instance (which kind of scared me).
So, I killed the processes and removed the user, good for me. But - what would be a good idea to also do? Something specific to look for in the logs? Reinstallation of packages? Nuke the thing from orbit?