Jonathan's questions

I am trying to run two sshd processes, one for admin and one for sftp. Ubuntu 14.04 on digital ocean has both upstart in '/etc/init/ssh' and init.d in '/etc/init.d/ssh`.

Is this just digitalocean or all 14.04?

Which one launches sshd? And which isn't being used / can i delete?

So far I've read each file and The files do not reference each other.

If my Amazon EC2 credentials are stolen at time D, can I verify the integrity of the root volume by:

1. Lookup the instance in EC2 API, check the time the primary network interface was attached, and use that as system creation time
2. Lookup the time the volume was attached
3. If the time the system was created is within 10 seconds of the time the root volume was attached, consider the system unmodified.

I'm assuming here that the instance was created before time D.

Another way to ask the question: This situation. I have an instance. I stop the instance. Someone steals (borrows) my AWS credentials, mounts the root volume of that instance to server B, modifies the root volume by adding their SSH key, and remounts it to the original server. How do I know the volume was modified before I boot the original server?