Recommended Free Tools
Treat an unexpected Linux server login as a lead, not proof of compromise. To decide whether it was authorized, preserve the relevant records, compare the account, time, source and authentication context with expected activity, then check for privilege use, account changes and persistence. The exact log paths and commands depend on the distribution and logging setup.
Preserve context before changing the server
Record the host identity, suspected account, event time and timezone, the alert or report that prompted review, and the time window you plan to examine. Note whether the server is business-critical and whether an incident-response or evidence-handling procedure applies.
As an Amazon Associate I earn from qualifying purchases.
When practical, preserve relevant records before rotating, clearing or editing them. For a serious incident, use authorized responders and established methods to collect volatile data and disk images when appropriate. Keep a detailed evidence log: what was collected, when, by whom and where it is stored. CISA’s incident response playbooks recommend evidence collection and preservation.
Establish what the login records show
Identify the authentication records available on this machine. They may be in the system journal, distribution-specific files under /var/log, or both. Include rotated and compressed logs in the review; the relevant event may no longer be in the current file. CISA’s joint advisory on uncovering and remediating malicious activity advises archiving /var/log contents and journald output. Paths and service-unit names vary, so do not assume one command or file applies to every server.
#1 Best Overall
Review successful and failed authentication events. For each relevant record, note the timestamp and timezone, username, source address if logged, authentication method or SSH context if present, and whether the attempt succeeded. Compare these details with authorized-user lists, change records, administrator schedules and the account’s normal access patterns. CISA advises collecting user logins and looking for outliers such as an unusual login time or an IP address the user does not normally use.
A burst of failures can indicate password guessing or scanning, but it does not show that an account was accessed. A successful login from an unfamiliar address deserves prompt investigation, but may have a legitimate explanation: VPN or bastion egress, dynamic addressing, an automated job or approved maintenance. Corroborate the context before drawing a conclusion.
Rank #2
Check what the account could do
Determine whether the account was expected to have shell or administrative access. Compare account records with a known-good baseline or configuration-management records, and look for unusual accounts, including service-like accounts with interactive shells. Review available sudo, audit and system logs for privilege changes and commands around the event window; availability and detail depend on the server’s configuration.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallInspect user authorized_keys files for newly added or altered public keys, prioritizing privileged accounts and accounts involved in the event. Additional SSH keys are an artifact CISA specifically identifies for investigation.
Look for persistence and follow-on activity
- Scheduled execution: Review cron entries and systemd units or timers for unexpected additions or edits.
- Temporary locations: Inspect
/dev/shm,/tmpand/var/tmpfor suspicious scripts or ELF binaries. - Kernel and system activity: Check loaded kernel modules and kernel messages for unexplained changes.
- Historical records: Include relevant system messages, journald data and archived logs in the timeline.
CISA’s advisory lists cron and systemd files, temporary-directory files, lsmod output, dmesg, logs and journald archives among Linux and Unix investigation artifacts. Treat timestamps and ownership as clues, not verdicts: they can be altered, and legitimate software creates files and services in these locations. Compare findings with known-good state, package records, deployment history and expected service behavior.
Correlate the host timeline with other records
Compare the event timeline with centralized log management, firewall and network-flow records, identity-provider or cloud audit logs, and other systems the account can reach. Check whether the same account or source appears elsewhere and whether the timing aligns across sources. A protected central copy can help distinguish host activity from missing, altered or incomplete local records.
CISA recommends enabling logs on servers and other systems, centralizing them, monitoring high-risk events such as failed logins and privilege escalation, and restricting access to stored logs. Its logging guidance for business systems covers these practices.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesEscalate and contain based on evidence
If unauthorized access is plausible, follow your organization’s incident-response process. Account for service dependencies and evidence needs before disabling accounts, changing keys, blocking addresses, stopping services or rebuilding a host. CISA’s StopRansomware Guide emphasizes preserving evidence that may be volatile or subject to limited retention.
Best Value
A source address may belong to a proxy, NAT gateway, VPN or shared egress point; blocking it can disrupt legitimate users and may not close other access paths. Changing credentials does not remove persistence or establish that an intruder has been evicted. Scope containment to the evidence, and involve the responsible security or incident-response team when available.
Choose an investigation scope that fits the incident
For a single event, start with the host’s available authentication records and account context. Expand the review when the account had elevated access, the login cannot be explained, or related activity appears elsewhere. Judge the approach along four practical dimensions:
- Evidence breadth: local authentication records alone, or also journald, sudo and audit records, central logs, and network or cloud records.
- Evidence integrity: local records, or access-controlled centralized or otherwise protected copies.
- Operational impact: passive collection and review, or changes that may disrupt service or alter evidence.
- Host context: expected accounts, maintenance, network egress and software changes compared with anomalous events.
No single tool is established as necessary for a one-server investigation. Adapt each step to the distribution, SSH configuration, logging setup, organizational policy and severity of the incident.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
