If this ever happens just use Ghost. Its the best
Announcement
Collapse
No announcement yet.
backup your system NOW!
Collapse
X
-
Originally posted by jetforce4004
If this ever happens just use Ghost. Its the bestthe fresh princess of 1338
What did I do to make you think I give a shit?
-
Originally posted by octalpussy
If this were to happen, it would be a little late for Ghost. Not to mention, you still have to make regular backups, or everything you've done since you made your disk image is lost.-- jedi
Comment
-
I have used this setup in the past...
3 drives... 1 system, 2 to create a mirrored volume.
Drive 1 serves for all system/program related things. Backup images of this are made after I update the system configuration / program installs. It doesn't have to be after everyone one, but after so long, it's not a bad idea to update the system image, eh?
Drive 2 and 3 are mirrored, so hereby reffered as Volume 2. Volume 2 is only and _always_ only data. This data is archived on a regular basis zip/rar for win32, tar.gz for the nix; then offloaded to two seperate places.
The first of these places being another system on the network where access to the data is relatively easy, but sheltered from any outside systems. The second, of course, being some form of media like cdr, dvdr, zipdisk, cf.. all depends on the type of system and size of data.
This has proven to be a relatively simple, painless way to quickly restore different types of losses/corruption without doing a full overhaul. With one exception.. my full 160GB storage device that shit out... and that was my fault for not having 2 available.if it gets me nowhere, I'll go there proud; and I'm gonna go there free.
Comment
-
But there's more to it than just Ghost.
Originally posted by jetforce4004
If this ever happens just use Ghost. Its the best
*BEFORE* any other users touch the box, ghost or dd it to removable backup media. 'Removable' is a flexible term in this case: it may be a mirrored drive, or it may be a compressed version of the reference install on a burned CD. Either way, the end result is the same.
Every month or so, pull out that backup and apply updates as necessary on a second machine that your users can't touch. Re-ghost/dd that box. You now have an up-to-date OS install for quick disaster recovery.
Step 2: if you'd read ahead, you'd know that I was going to recommend backing up *only* user data after the box went live to a secondary source ;) . Here's why:
Let's say the box gets royally 0wn3d. It's rootkitted/spl01t3d to hell & beyond, and your users' directories have active trojans sitting in them with all sorts of funky execute permissions applied all over the place.
- Do whatever forensics you need to do to determine the cause of the attack. Note those causes down for future reference.
- Reformat. Entirely. Blow the box away. It's good for the computer, it's good for the admin.
- Restore the OS from the recently-patched ghost/dd backup you've kept. Apply any interim patches you may have missed and re-dd/ghost. At least they shouldn't be much.
- Reinstall the software used to back up your users' data. Also reinstall any antivirus software you may be using, and update it (particularly in the Windows world).
- Restore your users' data, and check it for virii/trojans. Further, if you found the rootkit / exploit used to gain access, GET RID OF IT and deny logon and execute privileges to the user that spawned it as per your notes (you did take notes during the forensics period, right?).
- PATCH THE FUCKING HOLE. If one person got in, others will. Don't assume that only one person will find the weakness in the machine.
The basic idea here is to minimise the potential for a) an attacker to successfully exploit a box, b) wasting time on recovering from being owned, and c) it happening again.Last edited by skroo; January 19, 2003, 01:40.
Comment
-
Originally posted by Medic
I can lose two drives, as long as one has time to rebuld onto a spare..
--Medic
But definately a nice hardware-based route to take :)if it gets me nowhere, I'll go there proud; and I'm gonna go there free.
Comment
Comment