Overview

If you suspect your Pod has been compromised — strange processes, unexpected logins, spam being sent, or a defaced site — acting calmly and in the right order limits the damage. This article is a practical incident response checklist.

Before you begin

• Stay calm and avoid rebooting immediately. A reboot can destroy valuable evidence in memory.
• If you have the ALYPOD Console open, note your Pod's details for support.

Steps

1. Contain the incident. Take a snapshot of the Pod in the ALYPOD Console before changing anything, so you preserve a copy for analysis. If the Pod is attacking others or spewing spam, ask ALYPOD support to isolate the network.
2. Preserve evidence. Copy logs before they rotate:

bash sudo tar czf /root/incident-$(date +%F).tgz /var/log

1. Identify the entry point. Review authentication and web logs for the first suspicious activity:

bash sudo grep -i "accepted\|failed" /var/log/auth.log sudo tail -n 500 /var/log/nginx/access.log

1. Rotate all credentials. Change the ALYPOD account password, database passwords, application admin passwords, and replace SSH keys. Assume anything on the disk is compromised.
2. Remove persistence. Check and clean cron jobs, systemd units, ~/.ssh/authorized_keys, startup scripts and unknown user accounts.
3. Patch the vulnerability. Apply updates and fix the misconfiguration or vulnerable application that allowed entry.
4. Rebuild if in doubt. The safest response to a serious intrusion is to deploy a fresh Pod from your known-good image and restore only your data and configuration from a trusted backup.
5. Notify affected users and, where personal data is involved, follow your GDPR breach obligations.

Troubleshooting

• Problem: You cannot tell whether a process is legitimate. Solution: Search the binary's package with dpkg -S <path> or rpm -qf <path>; unknown ownership is suspicious.
• Problem: The attacker regains access after cleanup. Solution: You likely missed persistence or a backdoor — rebuild the Pod.

Related articles

• [Auditing logins and access]
• [Protecting your server against malware]
• [Keeping your server patched]