Member Avatar for inikam

I am looking for some instructions or guidelines to use in rebuilding a Unix machine that has been compromised. If anyone knows of any links to pages that have either rebuild or how to re-install the OS, please share.

thanks

  • 4 Contributors
  • 3 Replies
  • 138 Views
  • 1 Month Discussion Span
  • Latest Post Latest Post by alc6379

Dani AI

Generated

asked for practical rebuild/reinstall guidance; several replies (notably and ) correctly point out that a full reinstall is the safest path if forensic preservation is not required. The first decision is therefore procedural: preserve evidence for investigation, or contain and rebuild quickly to restore service. If legal or internal incident response is needed, collect volatile data before touching disks; otherwise plan a clean rebuild from verified media.

If preserving state, capture a minimal live-response bundle to an external device (do not install tools from the compromised host). Example commands to run once, redirecting output to a safe external mount:

ps aux > /mnt/usb/ps.txt
ss -tunap > /mnt/usb/net.txt
lsof -nP -i > /mnt/usb/lsof.txt
cat /proc/modules > /mnt/usb/modules.txt
dmesg > /mnt/usb/dmesg.txt
journalctl -b > /mnt/usb/journal.txt
dpkg --get-selections > /mnt/usb/packages-deb.txt
rpm -qa > /mnt/usb/packages-rpm.txt
dd if=/dev/sda of=/mnt/usb/image_sda.dd bs=4M conv=sync,noerror
sha256sum /mnt/usb/image_sda.dd > /mnt/usb/image_sda.sha256

For a rebuild: obtain installer media from the vendor, verify checksums/signatures, reformat target disks (or restore from an incontrovertibly clean backup), install the OS, fully patch it, and then harden before restoring services. Replace all credentials and keys (user passwords, API tokens, SSH host keys, and certificates), and treat backups as suspect until inspected. Reintroduce data only after integrity checks (checksums, file timestamps, source verification). Turn on centralized logging and monitoring before putting the system into production again.

For further reading and best practices see NIST SP 800-61r2 () and the SANS Incident Handler's Handbook (). Use tools like rkhunter and chkrootkit only as adjuncts; they cannot guarantee detection. For high-value systems, engage a professional incident response team.

Recommended Answers

All 3 Replies

Member Avatar for Rueful Rogue

You might start here where you'll find lots of experts on Unix as well as links to BLOG's dealing in just Unix. Go to:

I'm not a Unix guy, so this is all I can offer. Good Luck!

Member Avatar for fooumang

Are you looking to save what is currently on the system or start from scratch??

The first steps are identifying what, if anything, was affected and might still be causing damage.

Look in /tmp, /var/run, /var/tmp. Check for any process that you know shouldn't be running or anything that looks suspicious (like eggdrop).

Change your passwords (all of them)

If whats on the box doesn't matter much, I'd reformat and reinstall.

Member Avatar for alc6379

If the box has been compromised, save your data, and reinstall. That's the only real way to ensure that there aren't remnants from some r00tkit laying around.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.