Re: [cobalt-users] RaQ4 - have I been hacked?

["Edward Bishop" <eddie@xxxxxxxxxxxxxxxx>]

Thanks again all for your kind thoughts and suggestions.

I responded a few hours ago but it never made the list for some reason
(?)

At the moment I am getting all the site files off using WinSCP which
is doing a great job; but of course I will have a lot of work to do
transplanting them to a new server - apart from the DNS issues a lot
of them use .htaccess, cgi, php etc.

When the panic's over I'll try to tie up the thread with a little
post-mortem.

--
Eddie


----- Original Message -----
From: "Steve Werby" <steve-lists@xxxxxxxxxxxx>
To: <cobalt-users@xxxxxxxxxxxxxxx>
Sent: Saturday, March 02, 2002 5:27 AM
Subject: Re: [cobalt-users] RaQ4 - have I been hacked?


> "Edward Bishop" <eddie@xxxxxxxxxxxxxxxx> wrote
> > I *have* been hacked.
>
> Any idea how?  That info. is always useful to the rest of us.
>
> > I desperately and urgently need suggestions as to how I can
either:
> >
> > 1. Get FTP working again temporarily
>
> It's impossible to say without physical access to the server.  If
it's not
> possible to fix it, you could install a new copy of ProFTP.  See
> http://www.proftpd.org/.  Of course you could try a different FTP
daemon if
> you prefer.  Another popular one is wu-ftpd.  See
http://www.wu-ftpd.org/.
>
> > 2. Find another method to download large amounts of data
>
> sftp or rsync.  You should have sftp installed if you installed ssh.
rsync
> is at http://samba.anu.edu.au/rsync/.
>
> > so I can move users' sites to another server (should only take all
> > night if I'm lucky and I'm only working a ten-hour shift tomorrow)
>
> Hindsight's 20-20, but it's probably a good idea in the future to
have a
> good backup and recovery system in place and move the backups to an
> off-server location periodically.  Good luck.
>
> --
> Steve Werby
> President, Befriend Internet Services LLC
> http://www.befriend.com/
>
>
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users
>