Please help: Server Restored, drive Slaved. How do I Recover Files now?

[dinko]

My hosting company contacted me and told me my server was attacking other servers. In short, my server needed to be restored and all files had to be SLAVED.

Now EV1 (my host) is telling me I need to recover all the files before they remove their other drive.

Can anyone help me do this? I want to make sure I don't lose any files.. that includes, emals, mysql, etc.

Dinko

 

[0031]

You may copy the following directories, to preserve data from Plesk:

/var/qmail - emails
/var/lib/mysql - databases

From /etc/psa/psa.conf you also may know:
HTTPD_VHOSTS_D - virtual hosts
DUMP_D - backups
MAILMAN_ROOT_D - mailing lists

Copy them preserving permissions/owners, but drop suid bits

also I recommend to review and copy /etp/{passwd,shadow,group,gshadow}

And anyway you need to know how exactly your server attacked another servers - there is a big chance that malicious scripts/exploits are among the data you triyng to save...

 

[dramirez]

I would recommend omitting to carry the contents of the queues in /var/qmail/queues (?).