Ways to determine if the Linux system is hacked

 -rw------- 1 jd jd 13829 Oct 10 17:06 /home/jd/.bash_history or maybe, you may You will see output similar to the following: 
 lrwxrwxrwx 1 jd jd 9 Oct 10 19:40 /home/jd/.bash_history -> /dev/null If you see the second, it means this .bash_history The file has been redirected to /dev/null. This is a fatal message, immediately disconnect your machine from the Internet, back up your data as much as possible, and start reinstalling the system. Finding Unknown User Accounts 
When you plan to do a test on your Linux machine, it's wise to first check if there are unknown user accounts. The next time you log in to your Linux machine, type the following command: 
 grep :x:0: /etc/passwd has only one line, I emphasize again, in a standard Linux installation, the grep command should only Return a line, similar to the following: 
 root:x:0:0:root:/root:/bin/bash If your system returns more than one line after typing the previous grep command, there may be a problem. . There should be only one user whose UID is 0, and if the grep command returns more than one line, it means more than one user. Seriously, although these are some good basic methods for discovering hacking behavior. But these techniques alone do not constitute sufficient security, and their depth and breadth are far worse than the intrusion detection systems mentioned in the article. My advice is that if you suspect that your system is really out of order, call a Linux security expert and refer to his comments. After all, Linux security can be done right away.