[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Possible comprommission, what to do ?

On Thu, Nov 13, 2014 at 10:18:23AM CET, Renaud OLGIATI <renaud@olgiati-in-paraguay.org> said:
> On Thu, 13 Nov 2014 09:57:48 +0100
> Erwan David <erwan@rail.eu.org> wrote:
> > 	I just got a call form police, that they have arrested a
> > pirate who "tried" to connect to one of my (debian) servers. They tell
> > me he is gifted, but since the policewoman I had one phone mixes
> > server, web site and email address, it may not be completely accurate.
> > 
> > However, I'd prefer be sure my server was not compromised, and at the
> > lower possibe cost (in time and work). Is there a way to check the
> > packages/installed files from outside sources (I may boot a fresh live
> > system in order to have clean utilities), or even provoke a reinstall
> > with a new download of the whole system ?
> Have you run rkhunter (or similar) to check if a root-kit has been installed ?
> Cheers,
> Ron.

No, not yet.

I'll check if it is on the live boot.

Reply to: