Member-only story
What I Check Every Week to Keep My Linux Servers Safe and Stable
--
Share
Intro: You don’t need a full SOC to keep your Linux servers secure — but you do need a routine. Over the years, I’ve developed a weekly checklist that helps me catch small problems before they become big ones. In this post, I’ll share exactly what I look at every week across both Ubuntu and Red Hat servers to stay ahead of attackers and avoid downtime.
1. Check for Unauthorized New Users
Look for accounts you didn’t create:
cut -d: -f1 /etc/passwd | tail
If you find any unknown users, investigate immediately. Pair this with reviewing /var/log/auth.log (Ubuntu) or /var/log/secure (Red Hat).
2. Review Running Processes
Use ps or top to look for weird or resource-heavy processes:
ps aux --sort=-%cpu | head
Unexpected miners or reverse shells often show up here.
3. Check for Suspicious Cron Jobs
Attackers love to hide persistence in cron:
sudo find /etc/cron* -type fcrontab -l
Also check /var/spool/cron/ for user-specific crons.