I am administrating a server and obviously i am slightly paranoid if its security is compromised. Hence i regularly try to check if the security is still intact. Here are the things that i do roughly twice a week, maybe you could comment on it and/or give some additions.
cat /var/log/auth.log | grep opened | grep sshd:sessionFor user logins (i know who is on vacation, hence these people should not login)
cat /var/log/auth.log | grep opened | grep rootto see if somebody gained root access (despite me)
- Loosely check the running tasks if something suspicious pops up
I do not really want to discuss safety measures, but rather how you check the security-integrity on a regular basis in few time (the stuff i do takes roughly 10 minutes).
Thanks for your help.