How to Find Out if Anyone Is Hacking My Linux Machine
- 1). Open a terminal emulator on your system. Click the main menu (in the upper left-hand corner if you use GNOME, lower left if you use KDE), then click on the "Terminal" icon inside the "Accessories" sub-menu if you use GNOME or the "Utilities" sub-menu if you use KDE.
- 2). Type "cd /var/log" into the terminal window. This will bring you to the folder in which Linux stores records of failed attempts to log into your computer.
- 3). Type "grep sshd /var/log/auth.log | less" into the terminal. This command will display the dates and times when sometime tried to remotely log into your computer over the Internet through SSH. If these are times in which you were not trying to log into your own computer, or times in which an authorized user was trying to access her own accounts, then it means that someone has been trying to hack your Linux machine.
