Linux Server Hacked? What to Do Step by Step

​

Before you start

• Work from a computer you trust. If your own PC may be infected, use another device to change passwords.
• Do not delete suspicious files yet. You need them to find out what happened.
• Have access to the VNC console and rescue mode on a VPS. On a dedicated server, open a ticket if you need console access or a reinstall.

​

What are the signs that a Linux server is hacked?

• Logins you do not recognise in last or the SSH log.
• New users, new SSH keys in authorized_keys, or new sudo rights.
• High CPU from an unknown process (often a cryptocurrency miner).
• Unknown cron jobs or systemd services.
• Outgoing spam or attack traffic, or an abuse report about your IP address.
• Changed website files, unknown PHP files in upload folders, or redirects to other sites.

​

Step 1: Cut off the attacker

sudo ufw reset
sudo ufw default deny incoming
sudo ufw allow from 203.0.113.10 to any port 22 proto tcp
sudo ufw enable

sudo firewall-cmd --permanent --zone=trusted --add-source=203.0.113.10
sudo firewall-cmd --permanent --remove-service=ssh
sudo firewall-cmd --reload

​

Step 2: Find out how they got in

​

Who logged in and when?

last -i -n 50
sudo journalctl -u ssh --since "30 days ago" | grep "Accepted"

​

Which users and keys exist?

awk -F: '$3 == 0 || $3 >= 1000 {print $1, $3, $7}' /etc/passwd
getent group sudo wheel
sudo find / -name authorized_keys -path "*/.ssh/*" 2>/dev/null -exec ls -la {} \;

​

What runs on a schedule or at boot?

sudo ls -la /etc/cron.* /var/spool/cron/ /var/spool/cron/crontabs/ 2>/dev/null
for u in $(cut -d: -f1 /etc/passwd); do sudo crontab -l -u "$u" 2>/dev/null | sed "s/^/$u: /"; done
systemctl list-unit-files --state=enabled --type=service
sudo ls -lt /etc/systemd/system/ | head -20

​

What is running and listening?

ps auxf --sort=-%cpu | head -20
sudo ss -tulpn
sudo ss -tnp state established

​

Which files changed recently?

sudo find /etc /usr/bin /usr/sbin /var/www /tmp /dev/shm -type f -mtime -7 -ls 2>/dev/null | head -50

​

Step 3: Rebuild and restore

​

Can I clean a hacked server without reinstalling?

​

Frequently asked questions

​

How did my server get hacked if I use strong passwords?

​

Should I report the attack?

​

My server is mining cryptocurrency. Is killing the process enough?

​

How do I prevent this next time?

​

Related guides