Boox Rooted, Need Migration Assistance

[C4talyst]

Hello,

I inherited a plesk 8.6 box this year w/ 500 websites on it. In the past few weeks I've realized the machine has been rooted. I have extra boxes sitting around with similar hardware. What is my best route for migrating all my websites to a new machine, while preserving all ip address configurations, email, databases...etc.

Thanks,
C4t

 

[igors]

Hi,

The easiest way would be to use migration manager utility shipped with Parallels Plesk:
http://download1.parallels.com/Plesk/Plesk8.6/Doc/en-US/plesk-win-pmm-guide/index.htm

 

[atomicturtle]

This is the procedure we've documented for handling a Forensic Migration of a compromised system:

http://www.atomicorp.com/wiki/index.php/Compromised_System

 

[C4talyst]

Thanks very much for the feedback guys, I'm looking at these options now...

 

[C4talyst]

Hey atomic, your tutorial does not include any commands for making the map files...are they needed?

 

[atomicturtle]

yeah its a work in progress, you can generally grab a capture of memory using the "dd" command. It depends on the version of the kernel though, newer versions have put a number of restrictions on what you can get at from userspace. "dd if=/dev/kmem of=foo" or "dd if=/dev/mem of=bar" is a good place to start.