Hello,

after my sewrver was hacked some time ago and I had to reinstall all the software, I wonder whether it is a good idea to make a tar file
which is kept on the harddisk and what I can ftp to my local pc.
In case something goes wrong, I use a new installation and extract from that file so that I have the original installation including users, sites etc.

if this idea is good, how is the tar for that?
I tried tar cvzf back.tgz /

but I receive an error at the end.

Any Opinion from our gurus ?

Thanks, Joachim

What I do is have two hard disks, and have a 3 day backup cycle.

Simply just a cronjob which tars up the important files and saves on the local disk.

If you get hacked, you more than likely will have a rootkit installed, or ever worse a kernel root kit. If this is the case, you shouldn't restore backups of your entire server.

Just the files which are irreplacable - ie; httpd conf files, name server files and users files.

If you have a root kit or a kernel root kit, your best option is to update all your source and re-compile your kernel. Otherwise you will shoot yourself in the foot :)

mmhh, yes I know.
I know I maybe have the hacked version inside my tar, but I could an older one and just add the few users and some sites changing. It is rather static.
It´s like a restore with incremental files. Furthermore,
I could test the version on a different pc somewhere.
what exact tar comman dare you using? the on eI describwed produces an error, I think I have to exclude the backup file which is created.

Joachim

tar -cf --preserve filename /home

preserves your permissions for a quick and easy restore ;)

gzip -9 filename is a nice little addition too for compression

Sorry I don´t understand.

tar -cf --preserve filename /home

produces 2 files, "filename" and preserve.

I do not want to tar the /home, but the entire strucure.

what do I have to do then ?


Joachim

type man tar

technical forum is that way down the hall, aroudn the corner ------->