[BlueOnyx:10489] Re: BQ - a bit of a panic

[Richard Morgan]

I'm no expert but do you know it's definitely hacked?  If so, just restore 
the whole box from a backup or you'll never be confident there are no back 
doors, etc.  BQ is EOL anyway, so prob BO/BX time.

However, it sound like something has got in tangle... is /var completely 
full and what error messages are you getting when you try and restart the 
services?

There is a book I use as a guide for troubleshooting - search Google for 
'nix intrusion'.  It's a bit old, but there's lots ideas.

Richard

----- Original Message ----- 
From: "Martyn Bailey" <martyn at solis.co.uk>
To: <blueonyx at mail.blueonyx.it>
Sent: Tuesday, May 08, 2012 10:38 AM
Subject: [BlueOnyx:10488] BQ - a bit of a panic


> One of our BQ boxes seems to have been hacked.
>
> Not sure which exploit or how, but all sites are 404ing.
>
> MySQL won't start, and admin loging via ssh gives an error about
> permissions.
>
> Can su - but not sure where to look at a temp fix to get the sites
> back up before migrating everything to a BO box.
>
> _______________________________________________
> Blueonyx mailing list
> Blueonyx at mail.blueonyx.it
> http://mail.blueonyx.it/mailman/listinfo/blueonyx