How to Tell if a Linux Computer Was Accessed Remotely

This guide helps you determine whether someone gained unauthorized remote access to your Linux system. You’ll learn how to inspect login records, active sessions, authentication logs, and other forensic clues. No prior security expertise is needed, but you should have sudo privileges on the machine you’re checking.

What You’ll Need

• Sudo or root access on the Linux system
• A terminal emulator (e.g., GNOME Terminal, Konsole, or SSH session)
• Basic familiarity with running commands and reading output
• Optional: a separate device to note down findings

Step-by-Step

1. Check currently logged-in users and sessions. Run who to see all active sessions. The output shows username, terminal, login time, and remote IP address if connected via SSH. Also run w to see what each user is doing and how long they’ve been idle. Look for users you don’t recognize or IPs that aren’t yours.
2. Review successful login history. Use last to display a list of all recent logins, including reboots. The output includes the username, terminal (e.g., pts/0 for SSH), source IP, and timestamps. Scan for logins at odd hours or from unfamiliar IPs. To see only SSH logins, use last ssh.
3. Examine failed login attempts. Run lastb (requires root) to view failed login attempts. A high number of failures from a single IP could indicate a brute-force attack. Note that lastb may be empty if the system doesn’t log failed attempts or if logs have been rotated.
4. Inspect authentication logs. The primary log file is /var/log/auth.log on Debian/Ubuntu systems, or /var/log/secure on RHEL/CentOS/Fedora. Use sudo grep 'sshd' /var/log/auth.log to filter SSH-related entries. Look for lines like “Accepted password for” or “Accepted publickey for” — these indicate successful logins. Note the IP addresses and timestamps.
5. Check for new or modified user accounts. Run sudo cat /etc/passwd and look for accounts with a shell (e.g., /bin/bash) that you didn’t create. Also check sudo cat /etc/shadow for password hashes (though you can’t read the hashes without root). A new user with UID 0 (root privileges) is a red flag.
6. Review SSH configuration and authorized keys. Check ~/.ssh/authorized_keys for each user, especially root. Run sudo cat /root/.ssh/authorized_keys and look for unfamiliar public keys. Also inspect /etc/ssh/sshd_config for changes like disabled password authentication or non-standard ports.
7. Look for suspicious processes and network connections. Run ps aux to list all running processes. Look for unusual names, high CPU usage, or processes running as root that you don’t recognize. Then run ss -tunap (or netstat -tunap) to show active network connections. Note any established connections to unknown IPs, especially on high-numbered ports.
8. Check for recently modified files. Use sudo find / -xdev -mtime -7 -type f to list files modified in the last 7 days. Focus on system directories like /etc, /bin, /usr/bin, and /tmp. Unexpected files in /tmp or new scripts in /etc/cron.d could be malicious.
9. Examine cron jobs and startup scripts. Run sudo crontab -l for root and each user, and check /etc/cron.d, /etc/cron.daily, and /etc/cron.hourly for unusual entries. Also list startup services with systemctl list-unit-files --state=enabled and look for unfamiliar ones.
10. Check system logs for other anomalies. Look at /var/log/syslog or /var/log/messages for errors or unusual activity. Also check journalctl -u ssh if using systemd, to see SSH service logs.

Common Mistakes

• Ignoring local logins: Remote access isn’t only SSH; someone could use a compromised local account via a physical console or a remote desktop tool like VNC. Check last for tty entries as well.
• Forgetting about log rotation: Logs may have been overwritten. Check if /var/log/auth.log has rotated files like auth.log.1 or .gz archives.
• Assuming a clean last output means no intrusion: Attackers can clear logs. If you suspect tampering, check for gaps in timestamps or missing entries.
• Overlooking root’s authorized_keys: Many attackers add a key to root’s account to maintain access. Always check this file.
• Not checking for backdoor users: A user with UID 0 or a user with a valid shell but no password could be a backdoor. Use awk -F: '$3==0 {print $1}' /etc/passwd to list all UID 0 accounts.

Tips

• Use last -a to show the hostname/IP in the last column, making it easier to spot remote IPs.
• Set up logwatch or auditd to get daily summaries of login activity.
• If you find an unfamiliar IP, use whois to see its origin, but remember that attackers often use VPNs or proxies.
• Check for SSH tunneling: If you see a process like ssh -R or ssh -L running, someone may have set up a reverse tunnel for persistent access.
• Keep your system updated and use a firewall to restrict SSH access to trusted IPs.

Troubleshooting

• You don’t have sudo access: You can still run who, last, and ps without sudo, but you won’t see detailed logs. Contact your system administrator.
• Logs are empty or missing: This could mean logs were cleared by an attacker or that logging is not enabled. Check if the rsyslog or journald service is running. If not, enable it and monitor going forward.
• You see a successful login from an IP you don’t recognize, but it might be yours: Check if you use a dynamic IP or a VPN. Compare the timestamp with your own activity. If in doubt, consider it suspicious.
• You find suspicious activity but can’t confirm an intrusion: Run a rootkit scanner like chkrootkit or rkhunter (install via your package manager). These tools can detect known backdoors.
• You think the system is compromised right now: Disconnect the machine from the network immediately. Preserve evidence by not shutting down (which may destroy memory), but if you must, take a memory dump first if possible. Seek professional help.

Frequently Asked Questions

Can I tell if someone accessed my computer remotely if they cleared the logs?

Log clearing itself is a sign of intrusion. Check for missing log files, gaps in timestamps, or empty files where there should be data. Also check for files in /var/log with suspicious modification times.

What does “pts/0” mean in the who output?

“pts/0” indicates a pseudo-terminal, typically used for SSH connections or terminal emulators. A login from pts/0 with a remote IP means someone connected via SSH.

Is it possible to see if someone accessed my computer via a graphical remote desktop?

Yes. Check logs for services like VNC (e.g., /var/log/vnc.log), XRDP, or X11 forwarding. Also look for processes like Xvnc or xrdp in ps aux.

How often should I check these logs?

It’s good practice to review login logs at least weekly. For high-security systems, consider automated monitoring with tools like fail2ban or a SIEM.

What should I do if I find unauthorized access?

Immediately disconnect the machine from the network. Change all passwords (including root and user accounts) from a trusted device. Review and remove any unauthorized SSH keys or user accounts. Consider reinstalling the OS if you cannot be sure the system is clean.

Can I use these methods on a system that uses a different log location?

Yes. The main log locations vary by distribution, but you can find them by checking /etc/rsyslog.conf or /etc/systemd/journald.conf. The commands like last and who work across most Linux distributions.

Related

• How to Fix WiFi Issues on LG V10
• Install macOS 12 Monterey Developer Beta Without Developer Account
• How to Fix No Service on Samsung Galaxy J5