사고 대응

# 1. authorized_keys audit on every fleet machine
ssh-keygen -l -f ~/.ssh/authorized_keys

# 2. Recent logins
last -50
lastb -20      # failed (Linux, sudo)
w

# 3. Unusual processes
ps -ef | grep -v "$(whoami)\|root" | head -30
ps aux --sort=-%cpu | head
lsof -i -P -n | grep ESTABLISHED

# 4. Crontab inventory
crontab -l
sudo ls -la /etc/cron.* 2>/dev/null
sudo find /var/spool/cron 2>/dev/null

# 5. New users
cut -d: -f1,3 /etc/passwd | grep -v 'nologin\|false'

# 6. Suspicious files modified recently
sudo find /etc -mtime -7 -type f
sudo find /usr/local/bin -mtime -30 -type f

# 7. Outbound connections summary
netstat -an | awk '/ESTABLISHED/ {print $5}' | sort | uniq -c | sort -rn

# 1. ISOLATE — disconnect from the network
sudo ifconfig en0 down                  # macOS
sudo systemctl stop NetworkManager      # Linux (or `ifconfig eth0 down`)

# 2. Snapshot for forensics — disk image, log copies
# (out of scope for this lesson — but do it before any recovery)

# 3. Rotate ALL keys — not just on this machine
#    Assume agent forwarding may have spread the compromise

# 4. Audit authorized_keys on every server in the fleet
for host in $(cat ~/.fleet/all.txt); do
    echo "=== $host ==="
    ssh "$host" 'cat ~/.ssh/authorized_keys'
done

# 5. Review logs for the suspected timeframe
sudo grep sshd /var/log/auth.log | grep 'Accepted'

# 6. If you can't determine scope — wipe and rebuild
#    Better than "clean" with hidden persistence