Re: [cobalt-users] RaQ4 - have I been hacked?

["Steve Werby" <steve-lists@xxxxxxxxxxxx>]

"Edward Bishop" <eddie@xxxxxxxxxxxxxxxx> wrote
> I *have* been hacked.

Any idea how?  That info. is always useful to the rest of us.

> I desperately and urgently need suggestions as to how I can either:
>
> 1. Get FTP working again temporarily

It's impossible to say without physical access to the server.  If it's not
possible to fix it, you could install a new copy of ProFTP.  See
http://www.proftpd.org/.  Of course you could try a different FTP daemon if
you prefer.  Another popular one is wu-ftpd.  See http://www.wu-ftpd.org/.

> 2. Find another method to download large amounts of data

sftp or rsync.  You should have sftp installed if you installed ssh.  rsync
is at http://samba.anu.edu.au/rsync/.

> so I can move users' sites to another server (should only take all
> night if I'm lucky and I'm only working a ten-hour shift tomorrow)

Hindsight's 20-20, but it's probably a good idea in the future to have a
good backup and recovery system in place and move the backups to an
off-server location periodically.  Good luck.

--
Steve Werby
President, Befriend Internet Services LLC
http://www.befriend.com/