On a Fedora Linux laptop, I occasionally boot from USB and verify the RPM package database. On servers, try to have secure remote logs. Use a different adminis

On a Fedora Linux laptop, I occasionally boot from USB and verify the RPM package database. On servers, try to have secure remote logs. Use a different administration SSH key for the log server so that even if your user account and ssh-agent was compromised the attacker can't use it to edit the logs. Have your firewall log new connections that aren't part of normal, regular service. Especially outgoing connections from servers. If a web server suddenly starts sending email on port 25 to France, it's probably hacked. Audit the logs for anomalies such as SSH connections from new remote IPs, etc. Or known user accounts at weird times. Why is your sysadmin coworker suddenly logging in at 4 am? Etc.