How to find out who is logged into a debian server?

Question

Debian

Server on debian 10, previous programmer quit, changed keys and root passwords.
Now I recently noticed that the nginx configs were edited.
How can I find out who is in? After all, the root passwords and SHH keys are not the same.

Answer 1

last

Answer 2

Logging into a Server with a Login is Not the Only Possible
Publicly accessible services can be vulnerable to attacks, unfortunately most (read all) companies don't think about the costs of protecting against this (and they can be very high) until it's too late.
At worst, if it was a programmer, then he could leave loopholes in the public service code, and not necessarily intentionally, just meaning some critical errors, you can use them to remotely access files and run the code.
Solution - conduct a full-fledged security audit of the company as a whole, and not just the server.