Last week I was faced with the situation every user and administrator dreads -- my Web server was hacked. Here's hoping you can use my experience as a guide to investigating your own compromised server, if and when the time comes.

The nightmare started when I returned to my office to discover 17 missed calls on my cell phone. A moment later, the phone rang again. A frantic customer complained of "eyes" on his Web site. I visit the site, and, lo and behold, discovered it proclaiming being "owned" by a hacking group. Upon further investigation, I discovered all the other Web sites on the Debian-based server had been defaced.

By Brice Burgess at Linux.com

[ Read more ]