DEV Community

Faruk
Faruk

Posted on • Originally published at Medium

Why I Treat Every New Linux Server as Already Compromised | by Faruk Ahmed | May, 2025

#already #server #compromised #check

Member-only story

Why I Treat Every New Linux Server as Already Compromised

--

Share

✍️ Full Blog Content:

Intro:

It sounds paranoid — but it’s not. Whether you’re launching a cloud VM, setting up a dev box, or inheriting a legacy Ubuntu server, assuming it’s already compromised changes the way you secure it. And more than once, this mindset has helped me catch things others miss. In this post, I’ll explain the exact steps I take right after deployment, and how they’ve saved me from future headaches.

1. Check What’s Already Running

Most admins jump straight into installing packages — I stop and look at what’s already live.

✅ Check open ports:

sudo ss -tuln
Enter fullscreen mode Exit fullscreen mode

✅ Run a top-level process check:

ps aux --sort=-%mem | head
Enter fullscreen mode Exit fullscreen mode

✅ See which services are enabled at boot:

systemctl list-unit-files --state=enabled
Enter fullscreen mode Exit fullscreen mode

💡 Caught once: An unexpected FTP server installed from a base image.

2. List All Users and Logins Immediately 

cut -d: -f1 /etc/passwdlast -a | head -n 10
Enter fullscreen mode Exit fullscreen mode

✅ Check .bash_history for each user ✅ Look for unknown or dormant accounts suddenly…

👉 Read Full Blog on Medium Here

Top comments (0)