What to Do When Your Linux Server Is Hacked: Incident Response Checklist
A practical Linux server incident-response guide covering containment, evidence preservation, credential rotation, persistence checks and recovery.
When a server may be compromised, the first goal is not to clean it as quickly as possible. The first goal is to understand what happened without destroying evidence or allowing the attacker to retain access.
1. Confirm the symptoms
Document what you observed: unexpected processes, authentication failures, new users, changed files, CPU spikes, outbound traffic or service failures. Monitoring history can be valuable because it may show when the first abnormal behavior appeared.
2. Contain access carefully
Depending on the incident, isolate the server from unnecessary network access while preserving the ability to investigate. Avoid indiscriminate deletion of processes or files until you have recorded the relevant evidence.
- Restrict unnecessary inbound and outbound traffic
- Preserve relevant logs and timestamps
- Identify active sessions and privileged accounts
- Consider a forensic or recovery workflow appropriate to the environment
3. Check persistence and privileged access
Review systemd units, cron jobs, SSH keys, users, sudoers configuration, shell profiles, startup scripts and unexpected binaries. Compare findings with a known-good baseline where available.
- Unexpected systemd services
- Unknown cron jobs and timers
- New SSH authorized keys
- Unexpected privileged users
- Suspicious processes and listening ports
4. Rotate credentials from a trusted environment
Assume credentials visible to the compromised server may have been exposed. Rotate SSH keys, API tokens, database credentials and application secrets from a trusted workstation or recovery environment. Do not simply change one password and consider the incident closed.
5. Recover and monitor
For high-confidence compromise, rebuilding from a known-good image is often easier to reason about than attempting to prove that every persistence mechanism was removed. Restore only verified data and immediately add continuous monitoring for the signals that mattered during the incident.
Add continuous monitoring before the next incident
Connect your infrastructure, receive telemetry and investigate incidents from one Shell Guard account.