re: samba and other apps

> Recently, a server was hacked and a rootkit was installed.  I've since
> backed up all the data,.conf files and special apps. Since the server
> has to be back online asap, I'm curious if it's possible to copy the
> backed up .conf files and some programs like samba over the newly
> installed version as long as they are the same version.  Or is it better
> just to do it from scratch?

It's okay to copy config files as long as you check them over, but not
password, group or shadow files. You can also restore database dumps.
Leave the binaries alone, they should all be considered dangerous.

For the most part though, the main config files are all so simple, they
take about 5 or 10 minutes each. It's stuff like ldap that takes so long.

> On the subject of samba, there is a smbpasswd file and smbusers file in
> the old samba directory.  Since the users uses W2KP as their desktop OS
> there is a command to add to samba the machine names to the system and I
> cannot remember what it was, does anyone have a location or know of a
> document that explains this.

Sorry, can't help you here. Use samba very little.

-- 
Keith Mastin
BeechTree Information Technology Services Inc.
Toronto, Canada
(416)696 6070