Is my server hacked? How to check your own server for warning signs

Nobody can prove a server is clean from the outside. What you can do is check the places attackers use and say honestly which ones you could not read. This is that checklist.

   your Mac ──ssh──▶ [ server ]
        │               │
        │  1. nonce ────▶ echo dnt-4f9a1c   (did we really reach it?)
        │  2. ◀──── dnt-4f9a1c               yes → read on · no → UNKNOWN
        │  3. read sshd_config, web folders, keys …
        ▼
    every verdict = result + the line it came from

Dante proves the connection first. No proof, no verdict.

What a check can and cannot prove

If an attacker has full control, the machine can lie to you. A check that reads the server therefore proves only what it reads. The honest results are found, not found in what I read and unknown. Dante follows exactly that: before it concludes anything it proves that its connection really reached the server (it must get its own random value back), and if it cannot read a proof the verdict is unknown, never safe.

The places to look

SSH settings (/etc/ssh/sshd_config): password login on, root login on, or empty passwords. "Safe" only if none of the listed settings is bad.
Authorized keys: keys you do not recognise in ~/.ssh/authorized_keys (for every account).
World-writable files in web folders and /etc: anyone on the machine, including a hacked web app, can change them.
Web shells: small scripts in the web root that run commands from a request. Look for recently changed PHP files, odd names and calls like eval(base64_decode(...)).
Outdated PHP and software: judged by version against known vulnerabilities. A version number alone never decides it, because distributions patch silently - so Dante says so instead of guessing.
Scheduled tasks: cron entries and systemd timers you did not create.
Open ports: services listening on all interfaces that should only listen locally.
A changed SSH host key: it can mean a reinstall - or someone in between. Compare the key the server shows with the one remembered in known_hosts before you type any password.

Check a server with Dante

Dante connects with your own key, only to a server you named, and only reads. It shows each result with the command output it came from.

$ npx dante-watch --ssh root@your-server --key ~/.ssh/id_ed25519
  channel confirmed (your-server)
  STEP NEEDED  SSH: PasswordAuthentication yes  ← /etc/ssh/sshd_config line 63
  UNKNOWN  PHP: php binary not found for this user

Illustration of the format, shortened. Real results show the command output they come from.

A fix is shown as a plan with the exact commands first. Nothing is changed until you say yes to that plan.

If you find something

Do not clean in place first. Note what you found and when.
Rotate every credential that lived on that server (SSH keys, database and API secrets).
If a web shell or unknown key was real, rebuild the server from a clean image and restore data you have verified.
Fix the way in (the weak setting or the outdated software), otherwise it happens again.

Check your own machine nowInstall Node.js, open a terminal, type npx dante-watch. Step-by-step for Mac, Windows and Linux.

Nothing to lose by looking.Dante only reads. It asks before every change and shows the command first. No account. Delete the folder ~/.dante and it is gone.

Your next stepNext: get warned when a stolen key is used →

Questions people ask

How can I tell if my Linux server was hacked?

Look for unknown SSH keys and accounts, recently modified files in web folders, unexpected cron jobs, strange listening ports and weak SSH settings. No read-only check can prove a compromised machine is clean, so treat results as evidence, not a guarantee.

Is PasswordAuthentication yes dangerous?

It lets anyone on the internet try passwords on your server. Key-only login is the safer default.

Does Dante change my server?

No. It reads. A fix is shown as a plan with the commands, and runs only after your clear yes.