Looking for FreeBSD Help
 

Long story short. It appears someone compromised my server and replaced some vital command files ( ls netstat ps du find killall pstree top vdir whereis) to Linux versions.

Does anyone have FreeBSD copies of these files they could send me?

I am hoping to replace these files and begin some sort of investigation and not have to do a OS reload..

Any other possible suggestions?

Thanks

If the server is compromised then you don't have any other option except to format the drive and reinstall, hope you have good backups. You can't trust anything your server tells you, there could be backdoors anywhere.

I will take my chances.. Awful hard to start anywhere when I cant even see what proccess are running

hey i can help you out if you want... contact me on ICQ.

that's why hackers install their own versions of ps, lsof etc... So they can hide the haxor processes they have running.

You really should do a reinstall.

format everything...and re install the OS...

Here's another hand for reinstalling from scratch. Restore data, not executables.

Thanks for the replies.

I agree with an OS reload.

But I would like to at least try and look into the issue before I go through with a re-install.

Without the proper tools I cant see ANYTHING

You need more than people to send you replacement files, get expert help so you can be sure it's not going to happen again.

I was a UNIX admin for NASA Im gonna tell you like it is man.

FORMAT and reinstall PERIOD

you are fucked if you dont

and afterwards make sure your security is audited by a real UNIX admin

Better to do it the other way around so it doesn't happen again. Security guy looks at the server now, figures out what went wrong, reinstalls and applies necessary patches.

total reinstall. it's the only way to be sure if your entire server is compromised.:2 cents:

Your server must've been really old because its not such a piece of cake
to get root on a freebsd server.
You probably had some 4.x, I would reinstall with a newer version of the os
and have the server locked down by someone who knows what he's doing.