What to look for on the server after hacking?

Question

linux

We lost access to the server via ssh, the user password was changed. The password has been reset. Purely visually, everything on the server is the same as before. What should you pay attention to if, purely theoretically, someone malicious was on the server and, perhaps, left something behind?
And could the password be reset by itself?
ubuntu server 20.04

Answer 1

In such cases, it is better to reinstall the OS to hell, IMHO.

Answer 2

to replace the server