Detecting and Recovering Linux System Intrusions: Log Checks & File Restoration

1. Intruder may delete machine log information

You can check whether log files still exist or have been cleared; example commands are shown.

2. Intruder may create a new file storing usernames and passwords

Inspect /etc/passwd and /etc/shadow files; example commands are provided.

3. Intruder may modify username and password files

Examine the contents of /etc/passwd and /etc/shadow to detect changes; example commands are included.

4. View recent successful login events and the last unsuccessful login

Check the "/var/log/lastlog" file; example commands are shown.

5. View all currently logged‑in users

Inspect the "/var/run/utmp" file; example commands are provided.

6. View users who have logged in since the machine was created

Check the "/var/log/wtmp" file; example commands are included.

7. View connection time (hours) for all users

Again, refer to the "/var/log/wtmp" file; example commands are given.

8. If abnormal traffic is observed

Use the "tcpdump" command to capture packets or the "iperf" tool to analyze traffic.

9. Examine the /var/log/secure log file

Attempt to discover intrusion details; example commands are listed.

10. Identify scripts associated with suspicious processes

a. Use the top command to find the PID of the suspicious process. b. Locate the executable file in the virtual filesystem.

11. Recover deleted important files after a confirmed intrusion

When a process has an open file descriptor to a deleted file, the file remains on disk and can be accessed via the descriptor.

The /proc directory contains in‑memory representations of processes; each PID directory holds information such as open file descriptors, which tools like lsof can display.

If a file is deleted while still open, its contents can be recovered from the corresponding descriptor using lsof and the /proc filesystem.

Assuming the attacker deleted /var/log/secure, you can recover it by:

a. Verify the file is missing. b. Use lsof to see if any process still has it open. c. Identify the PID (e.g., 1264 for rsyslogd) and file descriptor (e.g., 4) that holds the deleted file. d. Read the file via /proc/1264/fd/4 and redirect the output to a new file. e. Confirm that /var/log/secure is restored.