How to restore a hacked Linux Server

Marius Ducea has a great article on How to restore a hacked Linux Server. He provides a very practical baseline on how you should develop your own plan of action to restore a hacked Linux Server. These are the steps he recommends:

– Don’t panic. Keep your calm and develop a plan of actions
– Disconnect the system from the network
– Discover the method used to compromise the system
– Stop all the attacker scripts and remove his files
– Restore not affected services
– Fix the problem that caused the compromise
– Restore the affected services
– Monitor the system

I’ve a personal experience of restoring a hacked Linux Server. I agree with all of his recommended steps. Out of them, I think finding the method (security hole) used to compromise the system is most important, because if you don’t know this then the attacker can immediately use the same security hole to attack and compromise the system after you restore.

Be Sociable, Share!
Posted in Admin, HowTo, Links, Linux/Unix, Network, Random, Security, Technology

Leave a Reply

Your email address will not be published. Required fields are marked *

*

Recent Comments

DeAnna on Meeting Buddha Boy: Whether he did or didn’t hurt someone…(February 16, 2017, 1:55 am)
http://www./ on iPhone first impression: They are mostly scams. If they require…(November 25, 2016, 10:29 am)
fifa4joy on Donate to my Mo, save a Mo Bro: You’ve gotten impressive knowlwdge these…(November 1, 2016, 11:06 am)
schnellkredit auch hartz 4 on iPhone first impression: Rodger, thanks for the clarification, which now…(October 31, 2016, 12:35 pm)
steamcsgoskin on Meeting Buddha Boy: good!good…(August 5, 2016, 8:10 am)