Fix and Restore website after DoS attack that took website down. -- 2

The website is Drupal, Received the following message from the company hosting about my website and I simply need the compromise fixed and the website restored. From Hosting: It does appear to have been a SYN flood. It is possible your Linode was compromised. To determine if this is the case, you may want to audit the following log files and writable directories: - "/var/log/[login to view URL]": You may have fallen victim to a SSH brute force attack. - "lastlog": You can cross reference recent account logins with the brute force attempts in "/var/log/[login to view URL]". - /tmp: This directory is often used by attackers to store their files in. - Web server logs: You may have installed a vulnerable script or web application. - "ps aux": Check for foreign processes. If you do find that your system has been compromised, I'd strongly suggest completely redeploying your Linode as it is often very difficult to determine the full scope of an attack. If downtime is a concern to you, the following guide will assist you with safely recovering your data and redeploying your Linode with minimal downtime: - [login to view URL] If you do not want to spin up a new Linode as advised in the above guide, you can simply deploy a new distribution and mount your old disk images within it to copy your data over. You will first need to free up some space to deploy the new distribution. You can do this by resizing your existing disk image: - [login to view URL] You can then deploy your new distribution and attach your old disk images to it: - Select the "Deploy a Linux Distribution" link on your dashboard. - Choose your desired distribution, fill in the the required values, and then click on "Deploy". - Return to the dashboard and select your new configuration profile. - Attach your old disk image to the drive setup of your new deployment - typically /dev/xvdc under Block Device Assignment - Boot into your new deployment and mount your old disk image. - Copy your data. Once you have redeployed your Linode, I'd also recommend implementing some of the security measures advised in our "Security Basics" guide to minimize the risks of a security breach in the future: - [login to view URL] You may need to boot into rescue mode to perform these tasks (you can ignore the parts about running a filesystem check): [login to view URL]