How would you know???

[elcapy]

I know my Linux box still fine but how would i know if my box has been compromised is there ways that you can tell for someone that does not know Linux so some of you guys in here, I just want to know so I keep an eye out for it if it ever does happen to me. thanks in advanced

[Dr Small]

Watch your auth.log for incoming requests.
/var/log/auth.log

[elcapy]

thanks I will keep an eye on it from time to time.:)

[HermanAB]

Like this:

$ sudo tail -f /var/log/auth.log

and
$ sudo tail -f /var/log/messages

Cheers,

Herman

[unoodles]

you could also install chkrootkit and rkhunter

[astrotech226]

Another neat way to monitor your system is with "tripwire". Once installed, it catalogs the files on your computer. There is some setup involved in what to ignore, etc...

A scan is run from time to time and it will alert you to file changes. This is big deal when files like "netstat" mysteriously change in the middle of the day and you have run no updates.