What to do if a server is hacked? Will Red Hat assist with development of security rules and policies and root cause?

Solution Verified - Updated -


  • There is reason to believe that my server was hacked

  • The host started presenting abnormal behaviors

  • Sudden jump in network bandwidth and/or traffic consumption

  • Unknown allocated space on disks

  • New users/groups created on the system with random names

  • An unknown root SSH login happened

    Jan 01 10:50:09 server sshd[444]: Accepted password for root from port 4729 ssh2
    Jan 01 10:50:09 server sshd[444]: pam_unix(sshd:session): session opened for user root by (uid=0)
  • Crond will not start

    starting crond : /bin/bash: crond:command not found
  • An untrusted IP address was able to login into my system


  • Red Hat Enterprise Linux (RHEL) all versions

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content