LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Closed Thread
  Search this Thread
Old 05-17-2012, 10:19 AM   #1
dayid
Member
 
Registered: Apr 2012
Location: Austin, TX
Posts: 44

Rep: Reputation: Disabled
Server was hacked and now I can't remove the attacker's user (off-topic, closed.)


Security breach? Reinstall and secure before attaching to network.

Seriously. Especially if it's a newer server so there's no a ton of customization to reimplement.


//Moderator.note: these posts have been pruned from another thread so they won't break the flow.

Last edited by unSpawn; 05-17-2012 at 03:05 PM. Reason: //Prune note
 
Old 05-17-2012, 10:32 AM   #2
Noway2
Senior Member
 
Registered: Jul 2007
Distribution: Gentoo
Posts: 2,125

Rep: Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781
Quote:
Originally Posted by dayid View Post
Security breach? Reinstall and secure before attaching to network.

Seriously. Especially if it's a newer server so there's no a ton of customization to reimplement.
NO! DO NOT DO THIS!

Dayid, While I understand your advice to be well meaning, LQ Security does NOT advocate this approach. Please avoid making this suggestion!
 
Old 05-17-2012, 12:28 PM   #3
dayid
Member
 
Registered: Apr 2012
Location: Austin, TX
Posts: 44

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Noway2 View Post
NO! DO NOT DO THIS!

Dayid, While I understand your advice to be well meaning, LQ Security does NOT advocate this approach. Please avoid making this suggestion!
Yeah, you're right. It'd be stupid to reinstall and secure a server after a security breach. It's much better to just try and rid the user and hope that they didn't leave anything behind... lol

You'll note that I never said to not have backups, to not investigate, to not "find the source" (which is encompassed in "secure server"), etc.
 
Old 05-17-2012, 01:42 PM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by dayid View Post
Yeah, you're right. It'd be stupid to reinstall and secure a server after a security breach. It's much better to just try and rid the user and hope that they didn't leave anything behind... lol

You'll note that I never said to not have backups, to not investigate, to not "find the source" (which is encompassed in "secure server"), etc.
In the LQ Linux Security forum we try to practice incident handling at a level that requires knowledge.
Please avoid posting replies that do not help the OP or support replies by others.
And please leave your lol posts in the General forum.
 
Old 05-17-2012, 02:11 PM   #5
dayid
Member
 
Registered: Apr 2012
Location: Austin, TX
Posts: 44

Original Poster
Rep: Reputation: Disabled
Thumbs up

Quote:
Originally Posted by unSpawn View Post
In the LQ Linux Security forum we try to practice incident handling at a level that requires knowledge.
Please avoid posting replies that do not help the OP or support replies by others.
My advice is sound: Attempting to recover a breached machine is an extreme amount more effort than starting with a fresh slate and making sure that it is more secure. The comment to make it more secure - requires knowledge - and requires an identification of the original breach. That all seems perfectly inline with the sentiment of this forum. I'll play elsewhere though as there seems to be more than enough cooks in this kitchen.

I'll keep my PM's set to mail me though in case you want to discuss this further without us mucking up the thread.
 
  


Closed Thread


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Server was hacked and now I can't remove the attacker's user tophi Linux - Security 10 05-17-2012 08:48 PM
Asterisk PBX hacked - looking to make sure all holes are closed simonmason Linux - Security 12 10-05-2010 07:41 AM
podcast topic: "Closed source drivers illegal" pterandon LQ Suggestions & Feedback 1 09-12-2006 11:26 AM
My server has been hacked, how to remove SUCKIT? ruleman Linux - Security 7 06-20-2004 06:25 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 09:55 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration