This question already has an answer here:
- Did I just get hacked? 9 answers
I run a Debian Stretch box. I had mistakenly forgot to delete a guest account I opened for a, well, guest of mine, and I suspect my system may have been compromised using that account. I'm not entirely sure, but I saw a few processes belonging to guest taking up CPU time - some
sshd's and a
/sbin/syslogd instance (which kind of scared me).
So, I killed the processes and removed the user, good for me. But - what would be a good idea to also do? Something specific to look for in the logs? Reinstallation of packages? Nuke the thing from orbit?