MDLog:/sysadmin: How to Restore a Hacked Linux Server

“Every sysadmin will try its best to secure the system/s he is
managing. Hopefully you never had to restore your own system from a
compromise and you will not have to do this in the future. Working
on several projects to restore a compromised Linux system for
various clients, I have developed a set of rules that others might
find useful in similar situations. The type of hacks encountered
can be very variate and you might see very different ones than the
one I will present, or I have seen live, but even so, this rules
might be used as a starting point to develop your own recovery
plan…”

Complete Story