Information Security: Detecting Server Compromises

“Q: How can I determine if my Linux server has been
hacked? How can I be sure that I haven’t been hacked?
-G.C.

“A: Being hacked is a lot like being
haunted–odd things are afoot that you may or may not notice. That
said, simple observation is the easiest way to detect when it’s
happened. For example, extra users running around your system–from
the obvious second superuser root account to the ‘sneaky john’
account that you never created–are easy to spot if you’re keeping
an eye on things. You might also observe file changes that you
never made, or programs running that you never started–such as a
sniffer, an IRC program or a file-sharing program.

“Beyond simple observation, my first tool of choice for
detecting server intrusions is the freeware Linux version of
Tripwire, which checks files to see if they’ve been altered, either
in their contents or metadata (ownership, permissions, etc.).
Tripwire’s an excellent tool for detecting break-ins, which often
involve changes to ‘critical’ system files. You have to run
Tripwire at least once to generate a baseline of your system’s
critical files. This baseline includes stored metadata for each
file, along with a ‘fingerprint’ constructed from its
contents…”

Complete
Story