My self-hosted database has been compromised by a hacker or malware, what is the recommended process for recovering my data, recreating the setup and securing it to prevent this happening again in the future?

edited by AHA
1 comment
  • @alamin20192019 Can you give more information about the database:

    • What MySQL version?
    • Was it hosted on the same Droplet as your Application? What other software was running on the Droplet?
    • What are the signs that indicate it has been hacked?
    • Are you currently able to access the database?

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
1 answer

Without the information AHA requested there isn’t much advice we can give you. I am going to assume you were using mysql or mariadb in which case the first thing I would do is to make a mysqldump of everything.

sudo mysqldump --all-databases > alldb.sql

next I would cat the file to be sure there was information in it.

cat alldb.sql

then I would place that in a gz file.

tar -cf alldb.sql.tar.gz alldb.sql

Here is some documentation on mysqldump

https://linuxize.com/post/how-to-back-up-and-restore-mysql-databases-with-mysqldump/

After that I would uninstall and purge the config files for your db.

sudo apt purge mysql
sudo apt purge mariadb-server

Then I would remove all associated packages…

sudo apt autoremove

Then I would clean all files…

sudo apt clean

After that I would install your db of choice but if you feel the old database was corrupted or compromised you should get a controlled environment where you can install your database of choice and disconnect from the web to prevent sending any information. Install the db and import the database. sift through the tables. Find what you cant that is safe and dump it to files then import into your new database on the main server.

Also to secure mysql you should run the following command.

sudo mysql_secure_installation

All of this and more is discussed here…

https://www.digitalocean.com/community/tutorials/how-to-secure-mysql-and-mariadb-databases-in-a-linux-vps#:~:text=%20How%20To%20Secure%20MySQL%20and%20MariaDB%20Databases,main%20configuration%20file%20for%20MySQL%20is…%20More%20

Hope this helps!

by Justin Ellingwood
MySQL and MariaDB are relational databases used in many unique situations. However, they can pose a security risk for your system and your data if you do not secure them properly. This guide will introduce some basic considerations and steps you can take to ensure that your data is more secure.
Submit an Answer