Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I had a server, 2 mirror hard drives ( software raid) CentOS5.

Some one access to my server and delete many files on server. I tested the hard by testdisk but it just find the folders and not it's content. I just has shell access to server.

What's the best recovery tools that offer command line recovery? Can I un-raid the hard drivess and try recovery on one of them? is this a good idea?

share|improve this question

2 Answers

up vote 4 down vote accepted

You should do two things:

  1. Since your server was compromised, you should take it offline immediately and audit how this happened. Once you know this, proceed to step 2.

  2. Restore from a known good backup, and while still offline, fix whatever vulnerability led to your initial compromise. RAID is not a backup, and shouldn't be treated as such. Recovering files with some file-recovery methods is possible, but restoring from backup (especially in light of the fact that you were compromised) is really the only reliable option.

share|improve this answer
the plesk log files shows that some one login by admin user and delete all customers and web sites and backups ( I had backups on same machine) the most important are mysql dbs which I dont have good backup – Ashian Dec 7 '11 at 20:31
2  
@Ashian They're not backups if they were on the same hard disks that you would be restoring to, they're just copies of files. What good are they there? You clearly didn't plan for total server failure, or for a compromise. It sounds like you're in too far over your head to resolve the reason for compromise by yourself. You might want to look at hiring a security consultant to analyze the problem. That is, unless your password is pony1 or something equally weak. Then you were just begging to be brute-forced. – MDMarra Dec 7 '11 at 20:34
4  
+1 !!! -> RAID IS NOT A BACKUP <- !!!! -- You have been taught an important lesson about why you need good, off-site backups which have been carefully verified through restore tests. Sorry you had to learn it the hard/painful way. – voretaq7♦ Dec 7 '11 at 20:37
@MarkM Password is a random text an contain lower case , upper case and digit, but the hacker can access to it,but I dont know how. – Ashian Dec 7 '11 at 20:52
@Ashian Then you should hire a security consultant. You should contact your customers and let them know that their data has most likely been stolen. You should not put that server back online until you've done the first two. – MDMarra Dec 7 '11 at 20:54
up vote 2 down vote

What MarkM said is good advice, but I just can't walk away from this question with out saying this.

If someone logged into your machine via ssh with the user name admin, and you don't have proper backups I'm going to go ahead and assume that you're not practicing proper security measures.

You need professional assistance with this. You will not do you, or your clients any good by just using a "old back up".

I'll provide a link to get you started on the right track if you do decide to handle this problem yourself.

http://pkeck.myweb.uga.edu/ssh/

Good luck.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.