Most of the time these attacks are automated, so there is no specific MO. Common points of entry are: * Unpatched or out of date software services running on y

Most of the time these attacks are automated, so there is no specific MO. Common points of entry are: * Unpatched or out of date software services running on your server * Unpatched or insecure web applications * Weak ssh passwords Finding the point of entry can be difficult. It's basically an exercise in log-diving. The location of these logs may vary based on your distribution, but look for information on: * SSH auth and security logs * General syslog * Web server access and error logs * Application logs Depending upon the level of access gained and the sophistication of the attacker's script, it may clean up after itself, which means you may not find anything. Security is layered, so there are no "5 easy steps to securing your servers" solutions. In general, you should: * Keep your distribution's software packages up to date * Keep any custom-built and off-the-shelf applications up to date with new releases * Use passwordless SSH key authentication with passphrases * If you must allow password authentication, use a service like fail2ban to block bruteforce attacks * Use a firewall like ufw to "default deny" access to services except those you explicitly want to provide access to Good luck.