UNIX for Dummies Questions & Answers

what approach can be taken on how you can investigate a reported breach and confirm whether the breach occurred or not. As of now it cannot be confirmed if the breach occured but its been reported that some key system files have been deleted.

Must assume that this is a Commercial Computing question and not a homework or interview question.

Let's assume that you have taken basic precautions and that the system is still running.

1) Disable LAN access to the computer immediately while you look. Pull the LAN cable and work from the system console. Change the root password from the physical console (in case your LAN has been compromised). A hacker will not expect this and you may stop the hacker covering his tracks.
2) Use lastb to look for repeated failed login attempts and hopefully get an IP Address. Also look for unexpected IP addresses in last.
3) Look at sulog for unauthorised elevation of privilege.
4) Look at Shell History for all root sessions and look for unauthorised commands. You do record them don't you?
5) Look at dmesg because many hackers forget this one.
6) Look at messages/syslog file for unexpected logged events.

Once you know where the hack came from, block it on your network firewall.

Thank you for your quick response.. that will surely help i hope.