I have a web server (Debian). I would like to know how to protect myself in case of hacking if a hacker changes commands such as netstat, ls.
I have to make a backup of such files as ls, netstat, and in case of a hack, return them and display the correct results (not hacked results). But these files are stored in /bin, /usr/bin and several other folders...
Where exactly can I make a backup of these commands, so that in case of substitution they can be returned? The question is probably stupid, but I would be grateful if someone could explain it to me.
Sorry for my English.
