I accidentally left an open port on my router, leaving access to one of my computers via SSH, using a rather insecure password. I noticed because I checked /var/log/auth.log and there is just one entry from the outside. There's no bash history nor anything easily noticeable. What should I check to know my computer is not compromised?

  • If root is compromised, they can tamper with the logs.
    – jordanm
    Jan 15, 2013 at 2:38
  • I know, they actually gained root access. But why should they leave their trace in auth.log?
    – Tomas
    Jan 15, 2013 at 2:44
  • 1
    I would say stat important files in your server.don't forget to read this and this Jan 15, 2013 at 3:38

1 Answer 1


Check thoroughly, if you want, but clever attackers may leave easy-to-spot signs but hide other cleverly hidden backdoors... It could be impossible to be sure...

The problem is, once compromised, the machine (and other machines it can access to) becomes unreliable (as it is impossible to know if they changed anything. So you have to assume that they did. And if they did, they could alter the OS/kernel, the commands, the filesystem, the boot sectors, anything. It could just act "normal" and hide specific files or folders or network packets. You can't trust any commands on a machine that got accessed by hackers.)

Usually the best tactic (and the fastest!) is the "nuke from orbit" approach : unplug that machine from all networks (lan, etc), backup docs, and reinstall the whole machine using a CD (ie, a clean and not tempered with source). And then restore only the docs on it (no exe, no dll, no binaries, no scripts (or check them thourougly), etc). And fix what allowed the breach in the first place before plugging it in the net again.

The problem is that, in addition to that machine, once having access to the lan they could have used tools to get access to any of the other machines as well (including the router).

The same tactic would apply on those too...

Leave the "investigation" part to other persons and other times (keep the disk around for when you have time).

For a mode detailled procedure, https://serverfault.com/a/218011/146493 , by RobM, is a good read, with sane and important steps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .