For most VPS users, security issues with VPS are often easily overlooked. Many people think that as long as the SSH port is changed and a complex enough password is set, the server will be safe.
But in reality, that’s not the case. Once our VPS is compromised, attackers typically hide their tracks, making the server appear perfectly normal on the surface, while in fact it’s already being used for cryptocurrency mining, as a jump host for attacks, or other illegal purposes.
Therefore, it’s crucial to regularly check your VPS for signs of intrusion. This is a habit every VPS user should cultivate.
Here, I’ll introduce a few practical and actionable methods for detecting VPS intrusions. You won’t need any complicated security tools—even beginners can follow along step by step.
1. Check for suspicious login records.
Checking login records is the first line of defense in determining if your VPS has been compromised. Any successful or failed login attempt will leave traces in the system logs.
You can also review SSH login logs, though log file locations differ slightly between systems. For example:
- Ubuntu / Debian systems:
sudo cat /var/log/auth.log | grep sshd - CentOS / Rocky / AlmaLinux systems:
sudo cat /var/log/secure | grep sshd
These logs record information such as login times, IP addresses, the users, and whether the login attempt was successful.
You can analyze abnormal login activity by focusing on:
- Whether there are IP addresses you don’t recognize
- Login records during periods when you weren’t operating the VPS
- Large quantities of logs like:
Failed password Invalid user
If you see a lot of failed login attempts within a short time, it’s almost certain your VPS is or was under brute-force attack.
On a regular basis, check for suspicious users and processes. Once an attacker has control of a VPS, they will often create hidden users, run malicious background processes, and occupy server resources for a long time. You should frequently check system user accounts:
- View all users:
cat /etc/passwd
Focus on the following:
- Users you didn’t create
- Accounts with suspicious names
- Non-system users with high privilege UIDs
If you find any suspicious users, be sure to further check their login records and privileges.
You should also examine currently running processes:
- View all processes:
ps aux
Pay special attention to:
- Processes with abnormally high CPU or memory usage
- Unknown
python,perl,bash,curlprocesses - Programs with odd command paths or those disguised as system processes
You can further use:top
to monitor system resource usage in real time. Mining programs, for instance, usually consume a lot of CPU constantly, which is a very obvious red flag.
Check if the filesystem has been tampered with. After breaking in, hackers often leave behind backdoors, malicious scripts, or executable files with abnormal permissions. You can check for files with elevated privileges (SUID) with the following command:
sudo find / -perm /4000 -type f
This will list all files with SUID permissions. Normally, there should only be a limited and fixed number of such files.
If you find any with abnormal paths, suspicious filenames, or which don’t belong to usual system programs, be highly alert.
Check for abnormal scheduled tasks (Cron). Hackers often use cron jobs to maintain backdoors or repeatedly execute malicious programs.
- Check current user’s cron jobs:
sudo crontab -l - Check system cron jobs:
sudo cat /etc/crontab sudo ls /etc/cron.*
Pay special attention to scripts you did not configure yourself, and any commands that regularly download or execute external programs.
2. Review system logs and watch for anomalies
System logs record nearly all key activities on your VPS, making them a critical reference point for intrusion detection.
Common system log files:
- Ubuntu/Debian system logs:
sudo cat /var/log/syslog - Authentication & sudo logs:
sudo cat /var/log/auth.log - General system info (CentOS systems):
sudo cat /var/log/messages
Pay close attention to abnormal phenomena such as:
- Repeated error logs
- Large numbers of failed network connections
- Services frequently restarting abnormally
- System activity at unusual times
These often indicate your VPS is under attack or has already been implanted with malicious programs.
3. Simple but effective additional checks
Besides the core methods above, you can also check current network connections:
ss -antp
Are there any unusual ports listening, or unknown services exposed to the internet? These could be backdoors left after an intrusion.
Conclusion
VPS security is not a “one-time thing” but an ongoing process. By conducting regular checks, you can spot signs of compromise early, avoiding server misuse and even provider bans. True security doesn’t mean you are never attacked, but that you can quickly spot and deal with problems when they arise.
Related articles! Apple CMS V10 Deployment Tutorial and Apple CMS V10 Deployment Tutorial Part 2
