My self-hosted database has been compromised by a hacker or malware, what is the recommended process for recovering my data, recreating the setup and securing it to prevent this happening again in the future?
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Without the information AHA requested there isn’t much advice we can give you. I am going to assume you were using mysql or mariadb in which case the first thing I would do is to make a mysqldump of everything.
sudo mysqldump --all-databases > alldb.sql
next I would cat the file to be sure there was information in it.
cat alldb.sql
then I would place that in a gz file.
tar -cf alldb.sql.tar.gz alldb.sql
Here is some documentation on mysqldump
https://linuxize.com/post/how-to-back-up-and-restore-mysql-databases-with-mysqldump/
After that I would uninstall and purge the config files for your db.
sudo apt purge mysql
sudo apt purge mariadb-server
Then I would remove all associated packages…
sudo apt autoremove
Then I would clean all files…
sudo apt clean
After that I would install your db of choice but if you feel the old database was corrupted or compromised you should get a controlled environment where you can install your database of choice and disconnect from the web to prevent sending any information. Install the db and import the database. sift through the tables. Find what you cant that is safe and dump it to files then import into your new database on the main server.
Also to secure mysql you should run the following command.
sudo mysql_secure_installation
All of this and more is discussed here…
Hope this helps!
@alamin20192019 Can you give more information about the database: