Linux Firewalls, Third Edition

Symptoms Suggesting That the System Might Be Compromised

Often, a successful attacker will try to hide their tracks with greater success, and therefore simple service monitoring won't be of assistance. The attacker might be far more skillful at hiding his tracks than you are at tracking down anomalous system states.

Linux systems are too diverse, customizable, and complicated to define an iron-clad, fully comprehensive list of definitive symptoms proving that the system is compromised. As with any kind of detective or diagnostic work, you must look for clues where you can—as systematically as you can. RFC 2196, “Site Security Handbook,” provides a list of signs to check for. The “Steps for Recovering from a UNIX or NT System Compromise,” available ...