[linux-help] Re: Hacked server

[Randy Reames <randy@xxxxxxxxxx>]

A short while ago Ron Straathof wrote:
> 
> Someone got into our Redht Linux 6.1 server and uploaded some of there own
> programs and files. When I try to delte these files or overwrite these file
> while logged on as root user I get the following:-
> 
> rm: cannot unlink `/etc/rc.d/init.d/network': Operation not permitted 
> 
> Can you please help!!!!!!!!!!!!!
> 

Unless you know exactly what they did to your server. The best thing you
you can do and what you SHOULD do is: Disconnect the server from the
internet, fire up your back-up server, you do have one right? Then wipe
and reinstall, preferably to the newest version with all the security
updates and errata, get it well locked down, get everything from your
backups back on, then reconnect to the internet.

RR
-- 
Randy Reames   randy@xxxxxxxxxx   www.reames.org   ICQ-115274915
Web Developer  Midwest Energy   www.mwenergy.com   Hays, KS, USA
"Do not dwell in the past, do not dream of the future, concentrate
 the mind on the present moment." - Buddha (c. - 483 BC)
-- This is the linux-help@xxxxxxxxx list.  To unsubscribe,
visit http://tmp2.complete.org/cgi-bin/listargate-aclug.cgi