It turns out that common-lisp.net wasn't attacked after all.

It has been verified that there was no real attack. We were spooked by a misconfiguration that caused software that wasn't supposed to be installed (specifically Samba) to run. Embarrassing but true. In retrospect we do still feel that the decision to take Common-lisp.net down was a reasonable one, given the amount of information he had at hand at the moment.