adminLinux Persistence and Suspicious Startup Review Checklist
After a server compromise, attackers may try to keep access by adding users, SSH keys, cron jobs, systemd services or startup scripts. A defensive review helps find unknown persistence points without guessing.
Core principle
Persistence means something survives logout, restart or reboot. Review every place where Linux can automatically start users, commands or services.
Checklist
- List human users.
- Review sudo users.
- Review SSH authorized keys.
- Review user crontabs.
- Review system cron directories.
- Review systemd services.
- Review enabled services.
- Review startup scripts and unusual service names.
- Review recently modified files in system paths.
- Document and remove unknown persistence only after verification.
Reusable lesson
This applies to VPS security incidents, unknown admin activity, malware cleanup, suspicious CPU usage and post-incident hardening.
When to Use This Checklist
Use this checklist after suspected VPS compromise, unknown users, suspicious services, unexpected cron jobs or repeated reinfection.
Required Tools
SSH access, sudo access, user list, cron files, systemd services, auth logs, backup
Before You Start
Do not delete system services blindly. Verify ownership, purpose and modification time before removing anything.
Structured Checklist Steps
- List users.
- Review sudo group.
- Review SSH keys.
- Review user crontabs.
- Review system cron.
- Review systemd units.
- Review enabled services.
- Review startup paths.
- Review recent system file changes.
- Document and remove confirmed unknown items.
Verification Steps
- No unknown sudo user remains.
- SSH keys are accounted for.
- Cron jobs are documented.
- Enabled services are known.
- Suspicious startup items are removed or isolated.
Rollback Plan
If removing a startup item breaks a legitimate service, restore the saved file or service unit and document why it is required.
Common Mistakes
- Ignoring authorized_keys.
- Forgetting cron jobs.
- Removing services without verification.
- No record of what was changed.
- Assuming malware cleanup is complete without checking startup persistence.
Related Commands
cat /etc/passwd
getent group sudo
find /home -name authorized_keys -type f -print
crontab -l
sudo ls -la /etc/cron.d/
systemctl list-unit-files --state=enabled
find /etc/systemd/system -type f -mtime -14