What I Do the Moment I Suspect My Ubuntu Server Has Been Compromised

Intro No Linux system is bulletproof. And no matter how tight your firewall rules are, attackers constantly evolve. So when something feels “off” — a strange process, high CPU usage, a weird cron job — I don’t wait. I act immediately. This is my step-by-step process when I suspect a breach on my Ubuntu (or Red Hat) server.

1. Disconnect the Network (If Needed)

If the behavior seems actively malicious (like outbound connections or heavy CPU usage), I immediately isolate the system.

sudo ip link set eth0 down

Or, if you’re remote:

sudo ufw deny out from any to any

🛑 Why? To stop data exfiltration or command-and-control callbacks.

2. Snapshot Everything

Before I reboot, I collect evidence.

• Copy /var/log/syslog, /var/log/auth.log, /var/log/nginx/ or /var/log/httpd/
• Copy the crontab: crontab -l, /etc/cron*
• Capture running processes:

ps aux --forest > /tmp/ps_tree.txt

• List current connections:

ss -tunap > /tmp/open_connections.txt

• Get active users:

who

3. Check for Suspicious Cron Jobs

Look in:

sudo ls -la /etc/cron.*
sudo crontab -l

I’ve caught crypto-mining jobs disguised as update.sh running every 10 minutes.

4. Audit Running Processes and Services

Run:

top
ps aux | grep -v root
systemctl list-units --type=service

Look for odd binaries in /tmp, /dev/shm, or user home directories.

5. Check Recently Modified Files

sudo find / -type f -mtime -2 | grep -vE '/var/log|/proc|/sys'

Look for unauthorized scripts, configs, or altered binaries.

6. Compare Installed Packages

List installed packages:

dpkg -l > /root/package_list.txt  # Ubuntu
rpm -qa > /root/package_list.txt  # Red Hat

Look for shady additions or rogue Python packages.

7. Decide: Clean, Restore, or Rebuild

If the root cause is clear and isolated (like a single cron job), a deep clean might work. But if:

• The attacker had root
• There’s evidence of backdoors
• You’re unsure what they did

🚨 I rebuild the server from a clean image. Always.

Conclusion:

Detection is good. But response is better. When I suspect compromise, I follow this checklist immediately — because hesitation could cost data, reputation, or more. Treat every compromise as serious. Assume persistence. Investigate like it’s real.

💬 Question: What would you check first? Drop your thoughts in the comments.

🙏 Thank you for being part of this community!

👏 Before you go: Be sure to clap and follow me!

📲 Follow me on social media: 🔗 LinkedIn: https://www.linkedin.com/in/bornaly/ ✍️ Medium: https://medium.com/@bornaly/subscribe 📘 Facebook: https://www.facebook.com/profile.php?id=61578778563015