[Sussex] Hacked server

[Brendan Whelan]

David, 

Thanks for the response - I switch from the default admin user to root and I could then create directories, etc.
I have managed to export the databases and pull them down to my PC.   Using SCP is a good idea - I will transfer key files temporarily to another server.

Brendan
  ----- Original Message ----- 
  From: David Moss 
  To: LUG email list for the Sussex Counties 
  Sent: Thursday, January 25, 2007 10:07 AM
  Subject: RE: [Sussex] Hacked server


  sudo?

  or how about stopping the server and scp-ing the whole DB to a local machine

  david.



------------------------------------------------------------------------------
  From: sussex-bounces at mailman.lug.org.uk [mailto:sussex-bounces at mailman.lug.org.uk] On Behalf Of Brendan Whelan
  Sent: 25 January 2007 09:59
  To: LUG email list for the Sussex Counties
  Subject: [Sussex] Hacked server


  Hi,

  Overnight someone has hacked into one of our servers which is hosted by an ISP. They have modified httpd.conf, clear out the logs and blocked the creation of files. The server needs to be rebuilt but I would like to extract the latest data from the databases but I can't create files.

  I have tried to "chmod 770 db" but get the message "chmod: changing permissions of `db': Operation not permitted" any suggestions on how I can overcome this problem?

  A bit move info:
  ls -ld db
  drwxrwxr-x  42 db       db           4096 Nov  8 10:28 db

   
  Brendan



  ________________________________________________________________________
  This e-mail has been scanned for all viruses by Star. The
  service is powered by MessageLabs. For more information on a proactive
  anti-virus service working around the clock, around the globe, visit:
  http://www.star.net.uk
  ________________________________________________________________________

  This message is from FDM Group Plc, and may contain information that is confidential or privileged. If you are not the intended recipient, please delete the message and any attachments and notify the sender. This email is not intended to create legally binding commitments on behalf of FDM Group Plc, nor do its contents reflect the corporate views or policies of FDM. Any unauthorised disclosure, use or dissemination, either whole or partial, is prohibited. FDM Group Plc is a private limited company registered in England (Reg. No. 2542980).


  ________________________________________________________________________
  This e-mail has been scanned for all viruses by Star Internet. The
  service is powered by MessageLabs. For more information on a proactive
  anti-virus service working around the clock, around the globe, visit:
  http://www.star.net.uk
  ________________________________________________________________________



------------------------------------------------------------------------------


  __ 
  Sussex mailing list
  Sussex at mailman.lug.org.uk
  E-mail Address: sussex at mailman.lug.org.uk
  Sussex LUG Website: http://www.sussex.lug.org.uk/
  https://mailman.lug.org.uk/mailman/listinfo/sussex
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.lug.org.uk/pipermail/sussex/attachments/20070125/59a3b152/attachment.htm