🚀 go-pugleaf

On Wed, 23 Dec 1998, Eddie Chiu wrote:

>       My Linux server got hacked. I can not login as root or anyone but I
> can FTP in to server.
>        Does anyone know how to recovery from this kind of the situation ?
>     Please help and send email to me.

Assuming you have your original boot disks, or a rescue disk.

Boot to the rescue disk, mount your hard disk somewhere, change to the
/etc directory on your hard disk, and copy the file passwd to passwd.org
or something similar.

Then use an editor to remove ALL accounts listed below the root account,
and edit the password field on the root account until it has nothing in
it.

Shutdown and reboot. You'll be able to logon as root and restore your old
passwd file, then reset your root password.

If you only have your original install disks, then you'll have to boot up
as if you intended to install - then toggle to another console {alt-F3, I
think, depending on distribution}, and follow the proceedure above.

If you do it this way, do NOT allow the installation to complete. Once
you've edited the passwd file, type sync a couple of times to flush any
cached information, and simple hit the reset button.

DaZZa