The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
2answers
687 views

What are my options with a downloaded Rackspace cloud image?

I've got an unresponsive Rackspace slice that has defied all attempts at accessing. I created an emergency image from this and deleted it, downloading the files that compromise the image to a local ...
10
votes
2answers
5k views

My linux server was hacked. How do I find out how and when it was done?

I have a home server running a desktop ubuntu distribution. I found this in my crontab * * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1 and when looking in that directory ...
0
votes
2answers
304 views

What logs should I check after a break-in?

I've asked this same question on superuser but I didn't have that much succes. I'd like to learn more about forensic analysis, and I'm doing the challenges from Project Honeynet. I need to check the ...
15
votes
8answers
2k views

What are main steps doing forensic analysis of linux box after it was hacked?

What are main steps doing forensic analysis of linux box after it was hacked? Lets say it is a generic linux server mail/web/database/ftp/ssh/samba. And it started sending spam, scanning other ...