Tell If Your Linux SSH Was Compromised

Unusual Login Activity

Unexpected or unfamiliar login attempts are a strong indicator that someone might be trying to access your system, or has already succeeded.

Check /var/log/auth.log or /var/log/secure (depending on your Linux distribution) for failed login attempts from unfamiliar IP addresses.
Look for successful logins at unusual times or from unexpected geographic locations.
Use the last command to see a list of recent logins and logout times.
The who command will show you who is currently logged into your system.

Tip

Regularly reviewing your authentication logs can help you spot suspicious activity early.

A compromised system might be running malicious processes or exhibiting unusually high resource consumption.

Use top or htop to view running processes and system resource usage. Look for processes with unfamiliar names or high CPU/memory consumption.
The ps aux command provides a more detailed list of all running processes. Pay attention to processes owned by unknown users.
Check network activity with netstat -tulnp to see open ports and established connections. Unfamiliar connections could indicate a compromise.
Examine the /tmp directory for unusual files or executables that might have been dropped by an attacker.

Important

Do not terminate any processes you do not recognise without first confirming their purpose, as this could destabilise your system.

Attackers often modify system files or configuration settings to maintain access or hide their presence.

Inspect the /etc/ssh/sshd_config file for unauthorised changes, such as new allowed users or altered port numbers.
Check the ~/.ssh/authorized_keys files for any unfamiliar public keys that could grant unauthorised access.
Use the find / -ctime -7 command (or a similar period) to look for recently modified files across your system, especially in critical directories.
Review your system's package manager logs (e.g., /var/log/dpkg.log for Debian/Ubuntu or /var/log/yum.log for CentOS/RHEL) for any unexpected package installations.

Good to know

Always compare current configurations with known good backups if available.

A compromised system might be covertly communicating with external servers, often for data exfiltration or command and control.

Use netstat -natp to display all active network connections. Look for connections to unusual IP addresses or on non-standard ports.
The lsof -i command can show you which processes are using network connections.
Check your firewall logs (e.g., ufw status verbose or firewall-cmd --list-all) for any unexpected outgoing rules.
Examine DNS resolution logs (if available) for suspicious domain lookups from your system.

Tip

Familiarise yourself with your normal network traffic to more easily identify anomalies.

Tags:

Was this guide helpful?

Know someone who needs this? Send them the guide.

Written by

Founder, CyberSecurityGuides

Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.

Reviewed by CSG Security Engineers