LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 03-24-2004, 02:32 PM   #1
abefroman
Senior Member
 
Registered: Feb 2004
Location: lost+found
Distribution: CentOS
Posts: 1,401

Rep: Reputation: 55
Help, server hacked!!! how do i restore system binaries?


Help, server hacked!!! how do i restore system binaries?

A root kit was uploaded an replaced a number of the server binaries such as w, netstat, ps, etc. How can I restore those but keep everything in /home, /usr/local/apache/, /etc/localdomain, etc?
 
Old 03-24-2004, 03:02 PM   #2
Jelle
Member
 
Registered: Feb 2004
Location: Utrecht, The Netherlands
Distribution: Debian
Posts: 79

Rep: Reputation: 15
Do not think you can get away with just reinstalling some binaries. Your system has been compromised, you cannot know the full breadth of the incursion. The best thing to do is reinstall from trusted media, and restore your data to that. If you need to make backups, boot with a trustable livecd like knoppix, and make sensible backups. You will have to do some heavy scrutinizing on all data you restore.

if you have a rpm-based system, check out the --verify option to rpm. this will give you some indication what is wrong. Oh and do a 'service network panic' to isolate yourself from the net. (or just pull the canble)
 
Old 03-24-2004, 05:16 PM   #3
Kovacs
Member
 
Registered: Jul 2003
Distribution: FreeBSD 8.2 RELEASE
Posts: 607

Rep: Reputation: 31
Time for a full reformat and reinstall.
 
Old 03-24-2004, 05:52 PM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,354
Blog Entries: 55

Rep: Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541
Help, server hacked!!! how do i restore system binaries?
Please check out the LQ FAQ: Security references. The "Compromise, breach of security, detection" part. Like the rest already said: you don't. Use the three R's: repartition, reformat and reinstall from scratch.


How can I restore those but keep everything in /home, /usr/local/apache/, /etc/localdomain, etc?
Verify those files manually, then backup if necessary. Don't backup binaries unless you have external and untaintable means of verifying integrity.


You will have to do some heavy scrutinizing on all data you restore.
Please don't use backups unless you have external and untaintable means of verifying integrity.


if you have a rpm-based system, check out the --verify option to rpm. this will give you some indication what is wrong.
...that is, if the system, binaries and rpm database can be trusted (which you can't unless you boot FIRE/PSK/Knoppix/distro bootcd with the rpm and (verified clean) db's on ro media). besides the rpm db doesn't pick up stuff installed or added outside of it. That's where Aide, Samhain or tripwire come in...
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
need X window system binaries for ARM sateeshgalla Linux - Newbie 0 09-26-2005 12:52 AM
log system hacked? mikechao Linux - Security 3 09-14-2005 10:46 PM
RH 8.0 system hacked sandalblady Linux - Security 4 07-03-2004 02:59 PM
Linux System being hacked saravanan1979 Linux - Networking 5 06-13-2002 06:59 AM
System was hacked. I need advice on restoration... Mogwai Linux - Security 4 01-17-2002 11:39 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 12:06 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration