Server Update — Part II

The prob­lem turned out to be some­thing other than a hard­ware fail­ure. The good news is I have set up a com­pletely new ded­i­cated server with a com­pletely new com­pany (who will be man­ag­ing updates and secu­rity for me). The bad news is, I lost ALL the data that was on the orig­i­nal server.

I do have local back­ups of web sites I did, but I lost data­bases, and peo­ple using web­mail lost saved email. Clients who were doing their own web sites may have lost their data if they wer­ent back­ing it up locally.

Brief recap of events:
1. Server was hacked at the end of July. I hired SeeksAdmin.com to go in and clean up the mess, patch every­thing, and lock it all down. Every­thing was great until the server some­how got rebooted (I had noth­ing to do with it), and it didn’t come back up. Accord­ing to 1and1, my server provider, the machine was stuck boot­ing up because it couldn’t load the ker­nel. They couldn’t select the pre­vi­ous ker­nel because Seek­sAd­min had locked down lilo, the boot­loader. I know Seek­sAd­min had men­tioned they had prob­lems with the new ker­nel work­ing, but they claimed they rebooted the machine mul­ti­ple times and rolled it back to the older ver­sion. I can’t prove or dis­prove that, but the cir­cum­stances are a bit con­cern­ing.
2. I was 99% sure that my back­ups were being per­formed by 1and1, and that all was OK when it came down to re-imaging the hard drive. Unfor­tu­nately, 1and1 locks out the backup FTP server from being accessed except from your ded­i­cated server. So, I had no way of ver­i­fy­ing that the back­ups were OK since the server wouldn’t boot and I couldn’t log in to look at the back­ups.
3. Seek­sAd­min re-imaged the server for me, and after get­ting it back up, I logged in and FTP’d to the backup server to check things out. Noth­ing was there. I was stunned, and I was very angry.

When all was said and done, I was left won­der­ing what had hap­pened. There is really no one person/company to blame, rather, a bunch of bad things con­spired from dif­fer­ent places to screw me over and cause a large night­mare for all the clients I had hosted on that server. Had 1and1 been doing the back­ups, which they were sup­posed to be doing, all would have been OK. But then, it seems the sys­tem had become unsta­ble since Seek­sAd­min had gone in to do their work, so I wouldn’t have run into the prob­lem if I hadn’t hired them. But then, if I never was hacked in the first place, none of this would have hap­pened in the first place.

The sil­ver lin­ing to all of this is that I had been itch­ing to leave 1and1 for quite some time, as they are the Wal-mart of web host­ing. I was stuck with them because the task of mov­ing all my clients was just too time con­sum­ing to think about. The new com­pany I set­tled with is all about ser­vice, and being sup­port­ive of their clients. They are smaller, per­sonal, and respon­sive. I also got away from hav­ing to use Plesk, and am now hap­pily set­ting up all the sites in WHM and CPanel.

 

Server Update

Not long after restor­ing and secur­ing my main web server after the hacker inci­dent, it has a hard­ware failure!

When it rains it pours. If you are one of my clients try­ing to fig­ure out why you can’t get your email or web site, it’s not just you. I am aware of the prob­lem and try­ing to get it resolved ASAP. Trust me.

Will

 

I Got Haxx0r3d

My ded­i­cated Linux server was hacked a few days ago. Specif­i­cally, some­one man­aged to com­pro­mise Apache by way of an out­dated PHP-based appli­ca­tion that a host­ing client of mine had installed. The hacker planted a script that tied up the sys­tem doing nefar­i­ous things such as portscans of other machines. My host­ing provider shut down the server, but neglected to tell me what had happened.

After punch­ing a hole through the illit­er­ate front­line sup­port tech­ni­cians, I finally got through to some­one who told me what was up. I was able to clean up the mess and unin­stall the vul­ner­a­ble appli­ca­tion. I have also con­tracted some secu­rity experts to harden the machine for me and help pre­vent this sort of thing from hap­pen­ing again.

I will also be keep­ing a closer eye on scripts that get installed on the server, mak­ing sure they are all patched with the lat­est updates of everything.

I am glad this wasn’t worse. It could have turned into a deface­ment or total crip­pling of the server. Not that I don’t have back­ups, but it would have been much more time con­sum­ing to fix.

In order to main­tain com­mu­ni­ca­tion with my clients dur­ing the down­time, I moved this site to a dif­fer­ent server quickly, and took the lib­erty of set­ting up the lat­est ver­sion of Word­Press, along with a spiffy new theme.

Enjoy.