How to restore a hacked Linux Server

Marius Ducea has a great article on How to restore a hacked Linux Server. He provides a very practical baseline on how you should develop your own plan of action to restore a hacked Linux Server. These are the steps he recommends:

– Don’t panic. Keep your calm and develop a plan of actions
– Disconnect the system from the network
– Discover the method used to compromise the system
– Stop all the attacker scripts and remove his files
– Restore not affected services
– Fix the problem that caused the compromise
– Restore the affected services
– Monitor the system

I’ve a personal experience of restoring a hacked Linux Server. I agree with all of his recommended steps. Out of them, I think finding the method (security hole) used to compromise the system is most important, because if you don’t know this then the attacker can immediately use the same security hole to attack and compromise the system after you restore.

Be Sociable, Share!
Posted in Admin, HowTo, Links, Linux/Unix, Network, Random, Security, Technology

Leave a Reply

Your email address will not be published. Required fields are marked *


Recent Comments

The light of Asia on Meeting Buddha Boy: DeAnna, what are you taking about? What…(March 30, 2017, 5:27 pm)
The light of Asia on Meeting Buddha Boy: Religious person don’t rape their disciple or…(March 30, 2017, 5:03 pm)
DeAnna on Meeting Buddha Boy: Whether he did or didn’t hurt someone…(February 16, 2017, 1:55 am)
http://www./ on iPhone first impression: They are mostly scams. If they require…(November 25, 2016, 10:29 am)
fifa4joy on Donate to my Mo, save a Mo Bro: You’ve gotten impressive knowlwdge these…(November 1, 2016, 11:06 am)