We recently faced a full scale attack on one of our servers running Open SUSE 11.0; the intruder deleted a lot of files necessary for day to day operation. Although the backups came in handy but for a initial few days, we went completely bonkers.
My question is how would you have handled that scenario?
Also apart from stepping up the security what other things should I be looking for, as the server is "behaving" a bit weird after the hack and at this moment we are suspecting that there is a script running left behind by the attacker so that he can come back later but we can't seem to find it. Is formatting the server a good idea?
Any other pointers and help are much appreciated.
Many Thanks.
