Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We recently faced a full scale attack on one of our servers running Open SUSE 11.0; the intruder deleted a lot of files necessary for day to day operation. Although the backups came in handy but for a initial few days, we went completely bonkers.

My question is how would you have handled that scenario?

Also apart from stepping up the security what other things should I be looking for, as the server is "behaving" a bit weird after the hack and at this moment we are suspecting that there is a script running left behind by the attacker so that he can come back later but we can't seem to find it. Is formatting the server a good idea?

Any other pointers and help are much appreciated.

Many Thanks.


merged by Jeff Atwood Jan 4 '11 at 4:31

this question was merged with How do I deal with a compromised server? because it is an exact duplicate of that question.