How to geht plesk content from Hacker Plesk 9.5 to 12.0.

[Eike_Reinel]

Hi,

I have a big problem: my VPS hosted by Strato was hacked and seems to be part of a botnet now. Until now I thought that the automatic backups of the provider would be enough and I did no separate backups using pleskbackup. Unfortunately the hacker attack was earlier than my oldest backup.

Now I want to move the complete server content including the configuration of approx. 10 domains to a new one. Therefore I want to make a backup of the plesk 9.5 server using pleskbackup to import it on the new server running plesk 12.

Problem: I can access the old server in recovery mode only, which means, that a recovery system runs with the content of the old server mounted under /repair. Is there a possibility to tell pleskbackup, that the content to backup is mounted under /repair? Otherwise it seems, that I have to move the content manually...
(I tried starting the old server in normal mode, but it immediately starts doing evil things, so this doesn't seem a good option...)

Any hints are welcome!

Greetings from Munich, Germany!
Eike

 

[UFHH01]

Hello Eike_Reinel,

you can always mount the standard hdd(s) with the command: "mount -t auto /dev/sdbX /mnt/mountpoint_name"

The following commands might interest you:

• Show the list of harddrives on your system: sudo fdisk -l
• Create a mountpoint-folder: sudo mkdir mountpoint_name
• Mount harddrive to a mountpoint-folder: sudo mount -t auto /dev/sdbX /mnt/mountpoint_name

Due to the case, that you say that you have been "hacked", I don't recommend doing a backup without investigating WHAT and WHERE you have been hacked. Your backups might include files, which are infected, or include additional files which might be the cause of botnet - activities on your server.

If you provide logs and informations about the "evil things", you might get help to solve your issues/problems, without a new installation.

 

[Eike_Reinel]

Hello UFHH01,

Concerning possible manipulation of my content: sure, you're right. I will check that.

What do you want to say with the commands to mount filesystems? In the running recovery system I have a mount point /repair, which contains the whole original system like /repair/bin, /repair/usr, and so on.
The only thing I need is the possibility, that pleskbackup uses /repair as the "root" of the server to backup when reading the data. So the best would be to have an option for this, second best would be an environment variable etc. to change in pleskbackup.

 

[UFHH01]

At "/etc/psa/psa.conf" you have several options for Plesk configured. You could try to change the paths and see if a backup might work, if you change these paths.

 

[Eike_Reinel]

Thanks, I'll have a look at it.