MySQL is busted, Need help backing up databases

[e980238]

Somehow my MySQL server got busted. None of the webpages are working that have to access it. Is there a way that I can back up the databases without having hte server working? Whenever I do anything on the command line I get this error:

ERROR 2002: Can't connect to local MySQL server through socket '/var/run/mysql/mys
ql.sock' (111)

[e980238]

ok i found out what was wrong. Once again my server was hacked.

[Dokeman]

lol...how did u get hacked and what did they do..

[e980238]

well i found 2 files in my /var/tmp directory called elvis1.ses and elvis2.ses and they have some type of script in them that does something to mysql. How i got hacked is beyond me. I only have the ssh port open and a port open for apache and niether of them are the defualt port.

[Mntsnow]

so were you able to get MySql running again? You can do a "dirty" backup of the "DATA" directory which will have directories within it that actually have the individual database files.

[qball]

Once again my server was hacked.

which server??? DB,Web,App???

Are you trying to back up a DB, so when it gets 'hacked', you can restore?

should look into stopping hacks.

my bad...

[gothic]

On a side-side note...

1.) Look into tcp_wrappers (/etc/hosts.allow, /etc/hosts.deny)

2.) tar -cvf mysql-backup.tar /var/lib/mysql/
=]

3.) You also might want to look into having MySQL only listen in localhost, and not any available interface. This can be done by adding "bind-address=127.0.0.1" (Without quotes) to your /etc/my.cnf (If you have one, since I don't know what distro you are on, etc) I do this, as a general security precaution to go along with #1

4.) Last but not least, can you paste those two Elvis session-history files? =] I'd be interested to see what they are trying to do.


*edit* I can't spell.

[e980238]

Actually I reinstalled the OS so I do not have those files anymore but it was on Slackware.