Member-only story
Intro:
Not all intrusions are loud. Some attackers sneak in, plant a backdoor, and leave — waiting for the perfect moment to return. During incident response on several Linux servers, I’ve found clever persistence mechanisms that most admins overlook. In this post, I’ll walk through seven backdoors I’ve personally discovered — and how to detect and eliminate them from your system.
1. SSH Keys Added to ~/.ssh/authorized_keys
Attackers often add their public key to existing users, especially root.
🔍 Check:
grep -r "" /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys 2>/dev/null
🛠 Fix:
- Remove unknown keys.
- Rotate legitimate keys.
- Restrict SSH to known IPs using AllowUsers or Match Address.
2. Malicious Cron Jobs
Hidden jobs run malware every minute/hour.
🔍 Check:
for user in $(cut -f1 -d: /etc/passwd); do crontab -u $user -l 2>/dev/null; donesudo cat /etc/crontabsudo ls -al /etc/cron.*/*
Free Linux Security Audit Tool
If you're checking a Linux server for suspicious activity, it's also worth reviewing SSH settings, user access, listening services, and firewall configuration.
I built a free Linux Security Audit Tool to make some of those checks easier. It runs locally and generates reports you can review afterward.
NextGenAlert Linux Security Audit — Free Community Edition
Top comments (0)