Easiest Way to Rebuild Server?

[reggie14]

So, I did something fairly stupid. I kept RDP open to my Sage server to the Internet, and someone over the course of several months managed to brute force the password. I'm not entirely sure when they got in the first time, but I do know they've been sending a fair bit of traffic to a mail server in the Netherlands, suggesting that they were using my Sage box to send spam.

I took some immediate steps to (hopefully) lock the attackers out, but I don't have a lot of confidence that the attackers didn't muck with the system in a way that I can't detect. And since I can't identify the specific moment that the system was originally attacked, I can't just restore a past backup. At least, not without going pretty far back (which might be worth it, actually).

I'm curious about my options here. If I go back to a really system image, then I'd need to update it back up to the current state. This is a bit easier to handle since there's no SageTV updates, although there's been some plugin updates over that time. I imagine I can probably just recover to an early backup, copy over my newer wiz.bin, and perform the plugin updates. I'd probably be ready to go at that point.

If I want to blow away the system and start from scratch, does anyone have pointers for how to make that the least painful process possible?

At this point, I'm tempted to restore to a 6 month old backup image and check the logs carefully to look for any signs of attack. If that doesn't work, I'll probably suck it up and rebuild from scratch.

[stanger89]

If your SageTV is fine, what you should be able to do is just copy/backup your entire SageTV directory. Nuke and pave the machine. Reinstall Sage and the drivers you need, and then just copy the backup Sage folder over the fresh install and all should be good.

Usually the reason that's not recommended is because the reinstall is trying to fix something with Sage, but if yours is fine, then that's not an issue.

[nyplayer]

Originally Posted by stanger89

If your SageTV is fine, what you should be able to do is just copy/backup your entire SageTV directory. Nuke and pave the machine. Reinstall Sage and the drivers you need, and then just copy the backup Sage folder over the fresh install and all should be good.

Usually the reason that's not recommended is because the reinstall is trying to fix something with Sage, but if yours is fine, then that's not an issue.

To add to what Stranger said which is the best way .... Make sure to setup your shares drive letters etc... the same way it was before... before restarting SageTV.

[SWKerr]

I had a hole in my firewall for a web server that I eventually shut down. At some point one of my HTPCs got assigned the same IP and guess what? It was suddenly someones spam server. This was back in the XP days but it amazes me how many hackers are out there trolling IP addresses.

I would wipe the whole server. Format and reload the OS.
As long as you have a recent wiz.bin you should be fine.

When I rebuild mine I did them as a clean start. Setup up everything the way you and want make sure it works. Then shut down the server and drop in you last wiz.bin. I have found SageTV deals with the movement of the recording directories without any real issues. Your favorites will also return without problems as long as you don't have something tuner specific setup. This seems to work even if you change the share names and disk locations.

[KryptoNyte]

A clean install presents an opportunity to purchase a new boot drive, maybe an SSD if you aren't already using one, and clean install to a new drive, yet still having the old drive available to boot from if you wanted to see how you had something setup previously.