QA

[vedantghode32]

I'm responsible for maintaining an Ubuntu server that allows remote administration through SSH.

I want to identify suspicious access mechanisms, such as unauthorized SSH keys, unexpected user accounts, or unknown services listening on network ports.

What security checks would you recommend to detect potential backdoor access without disrupting legitimate users?

[avirajsalunkhe]

I'd begin with read-only checks to establish what is currently configured and running.

First, review successful and failed authentication events:

sudo journalctl -u ssh --since "24 hours ago"

Then inspect user accounts and authorized SSH keys:

getent passwd
sudo find /home /root -name authorized_keys -type f

Review listening network services:

sudo ss -lntup

I'd also check enabled services and scheduled tasks for unfamiliar entries, compare the findings with a known-good baseline, and investigate any unexpected changes.

If unauthorized access is suspected, I'd preserve logs, isolate the server when appropriate, rotate potentially compromised credentials from a trusted system, and investigate the initial entry point.

For prevention, I'd enforce key-based authentication, disable direct root SSH login where appropriate, restrict access through firewall rules, apply security updates, and monitor authentication events.

A single unfamiliar port or key isn't proof of a backdoor; each finding should be verified against the server's intended configuration.