I've got kind of a situation here.
We need to get 2 servers under our control. The things we know so far:
- both are running linux, at least one is running Red Hat
- they are used as file-server, mysql server, and probably there's a sip server
- they are running apache and phpMyAdmin 3.4.1
- It is said that they are set up to mirror their data every 30 minutes
- the previous administrator said, that they are impossible to break in, and still have a working system.
- we don't have root passwords or any accounts on these systems
The previous administrator has been fired and has to be considered evil. He could have remote access.
One of the servers is no longer working correctly, and the old administrator said, if one of the servers is switched off, the whole system would break.
We don't know, how good he really is.
Our current plan: - switch off the servers anyway and make a full image. - put an additional firewall around the network - start one server up again - configure the firewall so that only sip traffic is let through
So we hope to get a working system, where the old admin is unable to remotely connect.
Then try to get into the other server to get to the configuration, and really gain control.
Do you any additional ideas? Do you see weak points?
Any thought welcome.
--- Update ---
Neither putting a firewall around the system, nor makeing an image of it had been accepted.
They tried to force us to just try to crack the password without any further precautions, so in the end we walked away.
The accepted answer is what we would have done.