Monitor your server: a step-by-step plan for spotting attacks early
Patching closes the doors; monitoring tells you when someone is trying them, or got in anyway. You do not need expensive tools. Set up these six layers on your server, one at a time, in this order.
1. Keep your logs, and keep a copy elsewhere
Attackers delete logs. Make sure your server keeps enough history and sends a copy to another machine. Logging and monitoring basics.
2. Get an alert when someone logs in
A message every time someone logs in over SSH, uses sudo or adds a user is the fastest way to notice a break-in. Login alerts.
3. Watch your web server logs
Most attacks arrive over the web. Learn what scans look like and block repeat offenders automatically. Spot attacks in web logs.
4. Know what normally runs and connects
Write down which ports listen and which outbound connections are normal, then get warned about anything new, such as a cryptominer talking to a mining pool. Watch processes and connections.
5. Notice when system files change
File integrity checks catch replaced programs and planted web shells. File integrity monitoring.
6. Add intrusion detection
auditd records security-relevant actions for intrusion detection; tools such as CrowdSec or Wazuh correlate events across servers. Intrusion detection on Linux.
When an alert fires
Do not panic and do not wipe anything yet. Check the signs of compromise, and if you find any, follow the first hour of incident response.