I have recently found a lot of brute force SSH attempts on my server. As a result of that, I have changed the port of my server and put a few firewalls in place to make it harder for my server to be brute forced.
As my server was open to the world for almost a year before then, I'm not sure whether there were any successful brute force attempts, and I'm concerned about potential Malware on my computer.
To that end, one of the things I'm doing is looking through my cron folders under
/etc. Should I be worried about potential Malware changing the cron files of valid programs like
php? Or do the cron scripts get overwritten and updated when I update the program?
It will make my job a lot easier if they update themselves. Then, I would just need to look out for files in my cron folders that have suspicious names.