Comment Comment by danesparza This has been covered elsewhere (like on serverfault: http://serverfault.com/a/107346/2557 )But it comes down to:- Take existing server down immediately. I'm assuming it is not on an isolated network -- so this should really be a priority.- Prep a new patched server (with a smaller attack surface and updated security credentials)- Postmortem the old box on an isolated network. Try to understand how the attacker got in. If necessary, get security professionals involved. parent danesparza 10 years ago
But it comes down to:
- Take existing server down immediately. I'm assuming it is not on an isolated network -- so this should really be a priority.
- Prep a new patched server (with a smaller attack surface and updated security credentials)
- Postmortem the old box on an isolated network. Try to understand how the attacker got in. If necessary, get security professionals involved.