my server was cracked; now what?

[Stephen Allen]

Aaron Vegh wrote:
> Hi there,
> I discovered this afternoon that my server was rooted. I don't think
> they were in there very long, but after noticing some of my services
> down, I went in and through the .bash_history file, saw some commands
> that were not issued by me. I changed the password on the root
> account, rebooted the box and made sure all services were running.
> Other than seeing some passwords missing in my mysql database I don't
> know what else was done.

You may wish to peruse the following URL;
<http://www.ducea.com/2006/07/17/how-to-restore-a-hacked-linux-server/>
__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
--
The Toronto Linux Users Group.      Meetings: http://tlug.ss.org
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml